Help on virus/malware removal?

[elkinm]

I got on a friend's laptop recently and noticed it had a whole lot of crap on it.
I cleaned up most of it including DrAntiSpy as well as some other apps and dlls.
The was no antivirus so I installed AntiVir free version which cleaned some stuff.

However there is still an issue, whenever in google or other search engine, the search is redirected with some add popup to go.google.com, but not to the actual page. If I click on the cached page option then it works.
The same problem occurs in FireFox so it's not just IE. Furthermore, windows update as well as many other sites for antivirus or antispyware are forwarded to 127.0.0.1, but not through the hosts file which is empty. (Automatic updates still work asking to install SP3),

Killing all apps did not help, but once I killed the svchost hosting DCOM Server Process Launcher and terminal services, IE stopped redirecting.
I am wondering if there may be a DCOM component loaded that should not be there. Anybody know of a good resource about DCOM and how to spot bad entries.

My time with the PC is very limited so I have not had a chance to disable DCOM or reset the winsock to see if that helps.
I did try installing ComboFix but antivir detected TR/Dropper.Gen in some of it's files. Is that normal? I heard ComboFix was really good at getting rid of tough viruses or malware.

The owner of the computer says the computer is running better than it had for months and is quite happy. I am not happy knowing it has some nice well hidden malware on the system.

Any other ideas or programs would be greatly appreciated.

Thanks
elkinm

 

[Sam25]

For removing malware you can run a scan with Malwarebytes in safemode.

 

[LittleNemoNES]

open "C:\windows\system32\drivers\etc\hosts" file
It should only say:

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

anything else could serve as a means of redirection.

 

[Snapster]

I actually fixed this on someone else's pc last night, it's a rootkit and buried like no tomorrow. It basically sends all software updates to 127.0.0.1, it also stops you even viewing any anti-virus or anti-malware websites.

To fix:

a) Go to Device manager and select view > show hidden peripherals
b) Disable the Tdssxyx.sys entry but not un-install or it will reinstall itself. (is in non plug and play drivers)
c) Reboot pc and you should now be allowed to browse the internet normally.
d) Install something like malwarebytes to remove the reg/files.

 

[elkinm]

Snapster, it was tdss just like you said. And removal was quite simple afterwards.

I also disabled DCOM, but strangely, Component Services crashes when I go to computers. Also windows updates works, but fails in the initialization stage. Something like bad security descriptors.
There is still damage to be fixed, but the main culprit is gone as far as I know.

Thanks again.