Antivirus XP 2008 Spyware problem...

[KubeDawg]

So somehow, I get this damned thing on my computer, and I flip out. It changed my desktop background, disabled certain options, and fucked up my Internet Explorer/Firefox browsers.

I updated and ran Spybot S&D, opened the Startup tab in msconfig and disabled both exe files at startup, restarted my PC, ran a full Spybot scan again, then updated Adaware and ran it, then reran Spybot, and everything seems to be gone. I've checked all files/registry settings listed on this site which helped a great deal to figure out what was going on:

http://www.xp-vista.com/spyware-removal/xp-antivirus-2008-removal-instructions-xp-antivirus-2008?cp=2#comments

And now everything is back to normal, all my desktop stuff is fixed, all registry settings back to normal, everything except my browsers. Thank god Google chrome came out in the time it did, else I'd probably still have this on my PC. Anywho, my IE still redirects me to some bullshit sites anytime I go to google.com, and my Firefox is a bit screwy, I notice when I'm on the FF forums, I see this:

http://kubedawg.com/fuckme.png
So somehow the formatting got jacked with and I'm not sure how to fix it.

And both browsers seem really sluggish. Does anyone know, other than reinstalling/repairing the browsers, a way or 2 to get this shit back to normal?
Thanks in advance.

[Shadow00Caster]

IE sucks at everything.

Whats the problem with reinstalling .. most likely will fix it.

[Pixel]

reformat!

[Innoc]

For firefox try running
"C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode

and when the load window comes up tell it to restore everything to default settings and see if that fixes it.

Edit: for IE If you're running IE7 try uninstalling and reinstalling it....as well as using the immunize mode and checking the home page. (srsly)

IE may be a thornier problem.

[Skanky Butterpuss]

hahaha i just had to get rid of that shit too like a week ago!

still dont know how i got it (i havent been on any porn sites besides pornhub, and havent DLed anything recently) :confused:


but yeah i used malwarebytes anti-malware and it got rid of it. havent had a problem since.

[Ricey]

First run, Smitfraudfix.exe and then Combofix.

Also, get HiJackThis! and post your log, do before and after.

[KubeDawg]

Here is what malwarebytes' picked up:

Malwarebytes' Anti-Malware 1.26
Database version: 1116
Windows 5.1.2600 Service Pack 3

9/5/2008 10:22:07 AM
mbam-log-2008-09-05 (10-22-07).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 143856
Time elapsed: 36 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\lphcaugj0eee1.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Administrator\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

[KubeDawg]

So I just restarted, but before I ran malware software, I had opened firefox in safe mode, I saved one of my recent bookmarks(8/29/08) to my desktop, and then restored everything to defaults. The same thing happened in my first post, still sluggish as well, so I knew there had to be something else. Now that I've completed the full scan on this PC, everything seems to be back to normal with both Firefox and IE. I just checked google.com, and it works wonderfully. Thanks to Zat, Shadow, and everyone else who suggested fixes for me. I'm going to continue to run this malware software for a while, along with regular doses of spybot/adaware scans.