Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

Bullguard support

Dec 26, 2008 6:44PM PST

Since last week i have had an attack that opens new IE7 pages with adverts, has destroyed all MS Office products, does not allow access to the website Bulguard support sends me to to down load freeware.
The daily "Bullguardhas been updated" must be a gimmic because it doesnt remove this attack that they know about, I have run 3 hour full scans in safe mode, sent them the results, but its still here.
See log Since last week i have had an attack that opens new IE7 pages with adverts, has destroyed all MS Office products, does not allow access to the website Bulguard support sends me to to down load freeware.
The daily "Bullguardhas been updated" mus be a gimmic because it doesnt remove this attack that they know about, I have run 3 hour full scans in safe mode, sent them the results, but its still here.
See log http://www.blamey.co.uk/log.txt

In Programs run at start up in CCleaner,
O4 - HKLM\..\Run: [dutotujedi] Rundll32.exe "C:\WINDOWS\system32\pafikiwu.dll",s
even if deleted or disabled reapears instantly

Please see below txt sent to Bullguard support

"Your really not listening,
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
will down load but not run at all,
http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWARE
The virus will not allow me to enter some sites in IE7 or Opera whit this one I get INTERNET EXPOLORER CANNOT DISPALY THE WEB PAGE.
When I try to update Adware I get "No internet connection", but as you see I have.
Its been nearly a week now, its no good refering me to sites it has blocked, I am astonished that Bull guard is asking me to down load this free ware to remove something it shhould not have let through in the first place.if you want me to update adaware or something else e mail me the file and tell me where to put it.
Absolutly disgusted with your product!!!!!!"

Discussion is locked

- Collapse -
I would suggest.......
Dec 27, 2008 5:48AM PST

Please download Malwarebytes Anti-Malwareand save it to your desktop.
alternate download link 1
alternate download link 2

* Make sure you are connected to the Internet.
* Double-click on mbam-setup.exe to install the application.
* When the installation begins, follow the prompts and do not make any changes to default settings.
* When installation has finished, make sure you leave both of these checked:
o Update Malwarebytes' Anti-Malware
o Launch Malwarebytes' Anti-Malware
* Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

* If an update is found, the program will automatically update itself.
* Press the OK button to close that box and continue.
* If you encounter any problems while downloading the updates,
manually download them from here
and just double-click on mbam-rules.exe to install.
Alternatively, you can update through MBAM's interface from a clean computer,
copy the definitions (rules.ref) located in
C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes'
Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.

On the Scanner tab:

* Make sure the "Perform Quick Scan" option is selected.
* Then click on the Scan button.
* If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
* The scan will begin and "Scan in progress" will show at the top.
It may take some time to complete so please be patient.
* When the scan is finished, a message box will say "The scan completed successfully.
Click 'Show Results' to display all objects found".
* Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

* Click on the Show Results button to see a list of any malware that was found.
* Make sure that everything is checked, and click Remove Selected.
* When removal is completed, a log report will open in Notepad.
* The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
* Copy and paste the contents of that report in your next reply and exit MBAM.

Note:-- If MBAM encounters a file that is difficult to remove,
you may be asked to reboot your computer so it can proceed with the disinfection process.
Regardless if prompted to restart the computer or not, please do so immediately.
Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

...

Download and scan with SUPERAntiSpyware Free for Home Users

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):

Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.

* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".

- Collapse -
No good
Dec 27, 2008 10:52PM PST

Even though I am connected, web page your links take me to show
Internet Explorer cannot display the webpage
Things i already have installed like Adaware2008 show "cannot update please connect to internet"!

- Collapse -
Give the following a try......
Dec 28, 2008 12:30AM PST

Click on Start, click Run, and then type devmgmt.msc and click OK
On the View menu click on Show hidden devices
Browse to Non-Plug and Play Drivers and you should see something like TDSSserv.sys
Highlight that driver and right click on it and select DISABLE
Now RESTART your computer.

Rename the downloaded installer file (MBAM.exe) to any generic name such as your own name but keep the .EXE extension on the file and run it. (go to the MBAM folder ( C:\Program Files\Malwarebytes' Anti-Malware) and rename the "mbam.exe" file ) !

Once the program is installed go to the UPDATE tab and try to update the program if you can.
Then go to the SCANNER tab and run a Quick Scan and allow MBAM to fix anything found.

Did it help?

- Collapse -
Yipeee!!!!
Dec 28, 2008 11:50PM PST

Seems to have done it, do I now enable the thing I disabled??

Many many thanks.

- Collapse -
Great Job :)
Dec 29, 2008 1:01AM PST
do I now enable the thing I disabled??

You mean the TDSSserv.sys?? NO way - you do NOT want that one - MBAM should have removed it. Does MBAM come up clean now?
- Collapse -
Many thanks
Jan 1, 2009 11:12PM PST

Marianna, still clean, Norton ghost backed up now, many many thaks.

- Collapse -
SUPER !
Jan 2, 2009 12:26AM PST