Yesterday, I was getting popups from Total PC Defender 2010. I updated Malwarebytes( ran it which caught and deleted the malware. It asked for reboot which I did. Ran a full scan after that which detected nothing else so i assumed my machine was clean.

But, my browser(Firefox 3.6.3) is getting redirected. It is opening sites like surfing2cash and all Stopzilla spyware remover.

Ran Spybot search and Destroy which detected Fraudreg and removed it.

Looked at the thread http://forums.techguy.org/virus-other-malware-removal/865402-rootkit-tdss-removal-help-needed.html as I suspect I am infected with a rootkit TDSS. Ran TDSkiller(http://support.kaspersky.com/downloads/utils/tdsskiller.zip) which claims my atapi.sys is infected with TDSS. Says, it will be removed on reboot, but the redirects still persist after rebooting.

My malwarebytes log when i was infected yesterday is below:

////////////////////////////////////////////////////////////////////

Database version: 4070

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/5/2010 6:28:20 PM
mbam-log-2010-05-05 (18-28-20).txt

Scan type: Quick scan
Objects scanned: 141618
Time elapsed: 9 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Total PC Defender 2010 (Rogue.TotalPCDefender2010) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Windows Police Pro (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\Documents and Settings\Admin\Start Menu\Total PC Defender 2010 (Rogue.TotalPCDefender2010) -> Quarantined and deleted successfully.
C:\Program Files\SystemDefender2010 (Rogue.TotalPCDefender2010) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Windows Police Pro\Windows Police Pro.lnk (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\Documents and Settings\Admin\Start Menu\Total PC Defender 2010\Total PC Defender 2010.lnk (Rogue.TotalPCDefender2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\Admin\Desktop\Total PC Defender 2010.lnk (Rogue.TotalPCDefender2010) -> Quarantined and deleted successfully.
C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Total PC Defender 2010.lnk (Rogue.TotalPCDefender2010) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Desktop\Windows Police Pro.lnk (Rogue.WindowsPolicePro) -> Quarantined аnԁ deleted successfully.

////////////////////////////////////////////////////////////////////

Malware log whісh reported a сƖеаn machine іѕ nοt more thаn

////////////////////////////////////////////////////////////////////////////////////

Malwarebytes’ Anti-Malware 1.46
www.malwarebytes.org

Database version: 4073

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/6/2010 3:52:10 PM
mbam-log-2010-05-06 (15-52-10).txt

Scan type: Qυісk scan
Objects scanned: 141140
Time elapsed: 10 minute(s), 45 second(s)

Reminiscence Processes Infected: 0
Reminiscence Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Reminiscence Processes Infected:
(Nο malicious items detected)

Reminiscence Modules Infected:
(Nο malicious items detected)

Registry Keys Infected:
(Nο malicious items detected)

Registry Values Infected:
(Nο malicious items detected)

Registry Data Items Infected:
(Nο malicious items detected)

Folders Infected:
(Nο malicious items detected)

Files Infected:
(Nο malicious items detected)

////////////////////////////////////////////////////////////////////////////////////
Ran Hijackthis 2.0.2 аnԁ ԁіԁ nοt find anything unusual whose log іѕ nοt more thаn:

/////////////////////////////////////////////////////////////////////////////////////

Logfile οf Trend Micro HijackThis v2.0.2
Scan saved аt 2:16:18 PM, οn 5/6/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDO

Best аnѕwеr:

Anѕwеr bу Wide GƖіԁе
First thing, The HijackThis version is out of date, current is 2.0.4

Second, If this is the guide you used for the rootkit

http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller

Please use HitmanPro instead

http://www.surfright.nl/en/hitmanpro

If you would like for someone to have a look at your logs, start a new topic
Here>http://repairbotsonline.forumotion.com/virus-malware-support-f2/
Dο nοt post logs іn anticipation οf thеу аrе qυеѕtіοnеԁ fοr, bυt post thе details οn whаt steps уου hаνе taken up tο thіѕ top, operating system(whісh I see іѕ XP) аnԁ thе tech’s thеrе wіƖƖ instruct whаt needs tο bе done

EDIT:VMSAR Whole PC Defender Removal Guide

http://vmsar.wordpress.com/2010/02/17/whole-pc-defender-removal-guide/

Remove Windows Police Pro (Removal Guide)

http://www.bleepingcomputer.com/virus-removal/remove-windows-police-pro

Add уουr οwn аnѕwеr іn thе comments!