Norton 360

[3play]

---

delphinium wrote:

I recommend extreme caution with any removal.  If you run any program that is capable of deleting the infected atapi.sys, you will no longer be able to boot into your computer.  .

---

I am not that stupid to recommend atapi.sys deletion/removal or whatever . Hitman Pro is a smart program which does not remove (delete) atapi.sys . Instead , it seeks for hidden clean copies of the file on all drives and if it finds one , it will replace it on reboot - thus cleaning the rootkit (patcher) infection.

[3play · Accepted solution]

---

ieweg wrote:

3play:

I ran Hitman Pro as you suggested, and (big surprise ) it found C:\WINDOWS\system32\drivers\atapi.sys infected still with the Backdoor.Tidserv virus.  I removed it per the on-screen instructions, rebooted, and rechecked Disk Management.  C: and D: drives are back!

Not sure of the protocol for posting a HijackThis logfile, so I just copied and pasted it here:

Perhaps Hitman Pro has dealed with the problem . Please , run scan with Hitman Pro once again until it shows you are clean . Run scan with Norton or other programs to ensure they will give you a clean bill

Uninstall Lavasoft's Ad-Aware , BitDefender online scanner and other applications you find unnecessary.

Open HiJackThis , press "Perfom a scan only" button . When it is finished , find the following entries , check them ONLY and press the FIX button

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"

At the end , close HiJackThis .

If it is OK now and you have no issues , please report that and click "Solved" on that that topic and case .

[Quads]

You don't have to worry about this entry, It's legit

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe

I remember when this poster got at least 1 hijackthis log wrong and asked a user to select services

http://community.norton.com/t5/Norton-Internet-Security-Norton/Malignant-growths-related-to-quot-Vis...

Careful

Quads

[3play]

---

Quads wrote:

You don't have to worry about this entry, It's legit

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe

I remember when this poster got at least 1 hijackthis log wrong and asked a user to select services

http://community.norton.com/t5/Norton-Internet-Security-Norton/Malignant-growths-related-to-quot-Vis...

Careful

Quads

---

Dear Quads , With all my respect , you are a "Guru" but stop trolling ! If you have something important to say , go ahead ! If you don't , please don't carp! HiJackThis is utility that is used not only to clean malware . The Adobe entry is legitimate entry but is absolutely unnecessary . This is Adobe's Speed Launcher and is not needed to run at computer start up. You can google for more information . I am well trained to clean malware . All I want to do is to help the OP and so far I haven't harmed anybody at this forum (Norton Community) . Enough!

[delphinium Norton Fighter]

3play:

Try not to take offence at my cautionary post.  I do not know you or have any idea what you know or don't.  It is standard policy to caution users.  It should also be standard policy to advise users to back up their data.

[SendOfJive Norton Fighter]

3play,

If there'e anything I have learned from these forums, it is that one man's unnecessary program feature is another man's highly-valued software asset.  The Norton Toolbar is a prime example.  It is rather presumptuous, don't you think, to advise removing things from someone else's computer without informed consent simply because you don't feel the item has any value or usefulness?

[huwyngr Norton Fighter]

ieweg,

No I'm sure that GHOST (nor any other imaging software) is not that intelligent!

AN image is an image ..... It's value to you would be that if some attempt to recover what you are using failed and you could not reach any of your personal data files then restoring the image would give you a second shot using another method.

Also from an image you can extract individual files or folders and as data files these are less likely to be infected individually and if all else fails and you had to use your Recovery Media to reinstall a clean machine then I believe that your Norton 360 would detect any infected file coming in when extracted from the image since it is usually much easier to detect and infected file than to prevent the incoming new malware -- that's partly why Malwarebytes and SAS do a good job cleaning up. I say "I beleive" becauses I'm pretty certain I've seen this said about GHOST and knowing where the engine comes from it should be a feature.

My real point is that every serious user should have and use imaging software and you have  a head start on pricing!

Hope that clarifies -- you are in good hands here for the recovery itself.

[huwyngr Norton Fighter]

3play,

You can make perfectly good contributions here without making personal attacks -- calling anyone posting legitimate information is a personal attack and that is against the rules here.

Nor should you take any message you disagree with as an attack.

Quads is a known expert in malware removal and in this type in particular. That you may also be does not entitle you to insult him.

However correct your are that Adobe Launcher is not needed Quads is perfectly correct in saying that it is a legitimate file -- so are many that are a dam' nuisance as this and many updaters but there is no necessity for them to be removed as in a malware cleanup operation; if they interfere with something then disable them from loading -- so please just leave it at that.

[Quads]

---

3play wrote:

---

Quads wrote:

You don't have to worry about this entry, It's legit

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe

I remember when this poster got at least 1 hijackthis log wrong and asked a user to select services

http://community.norton.com/t5/Norton-Internet-Security-Norton/Malignant-growths-related-to-quot-Vis...

Careful

Quads

---

Dear Quads , With all my respect , you are a "Guru" but stop trolling ! If you have something important to say , go ahead ! If you don't , please don't carp! HiJackThis is utility that is used not only to clean malware . The Adobe entry is legitimate entry but is absolutely unnecessary . This is Adobe's Speed Launcher and is not needed to run at computer start up. You can google for more information . I am well trained to clean malware . All I want to do is to help the OP and so far I haven't harmed anybody at this forum (Norton Community) . Enough!

---

Due to the fact it's a legit program and entry, then you just don'y go around deleting entries with Hijackthis or other programs as the other person may want programs installed like that, so the entries stay where they are. I don't need to Google it, And know how to use Hijackthis and how to read logs, but Hijackthis is easy.

That includes Windows services that you have previously asks user(s) to remove. "and so far I haven't harmed anybody at this forum" Yeah but with Hijackthis you tried to do so by telling telling them to remove Windows Services, that are required what would have happened if you succeeded in removal?? one Stuffed PC

Entries that are legit are to stay as people have their own PC setup for themselves. Not for You, Me or any one else here, In the Past with logs, in reply if a poster has stated the PC is slow, I have placed in brackets like.

(optional, not needed in startup) etc, so that it's up to the user to decide.

"Backdoor.Tidserv!inf" TDL3 variants, is reasonably easy now as there are free tools like TDSSkiller that can remove it for the user, the tools have to be keep up to date though, for new changes.

Compared to the first few people that I had to use the long handed logs and script.

Quads

[shannons Moderator]

Please keep this thread on topic and refrain from personal attacks per the  Participation Guidelines and Terms of Service.

Thanks!