TechSpot

Virus trojan galore

By theRadiantChild
Jul 13, 2010
  1. Hey Broni I got another one for ya. See log files.
    Thanks and goodluck!
     

    Attached Files:

  2. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    Oh i forgot to add that my buddy can't change his desktop background either. Its very bizarre indeed. I've read on different forums this could be a result of some malware on the system
     
  3. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Download Bootkit Remover to your Desktop.

    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
    • After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator.
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
     
  4. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    This is all I got:
    Bootkit Remover version 1.0.0.1
    (c) 2009 eSage Lab
    www.esagelab.com

    \\.\C: -> \\.\PhysicalDrive0
    MD5: 06d110c9544a53b0480ab0b2690fb1da
    \\.\D: -> \\.\PhysicalDrive0

    Size Device Name MBR Status
    --------------------------------------------
    465 GB \\.\PhysicalDrive0 Unknown boot code

    Unknown boot code has been found on some of your physical disks.
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>


    Press any key to quit...
     
  5. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Open Notepad
    Copy and paste following text into Notepad:
    Code:
    @ECHO OFF
    START remover.exe fix \\.\PhysicalDrive0
    EXIT
    Go FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
    Then in the FILE NAME box type fix.bat.
    Save fix.bat to your Desktop.

    Run fix.bat by double clicking.
    You may see a black box appear; this is normal.

    When done, run remover.exe again and post its output.
     
  6. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    I clicked the .bat file i made and it ased if I wanted to reboot immediately after disinfection. I selected "no" and this is what it said:
    Bootkit Remover version 1.0.0.1
    (c) 2009 eSage Lab
    www.esagelab.com

    Restoring boot code at \\.\PhysicalDrive0...
    ERROR: No standard boot code found for your OS.
    You can restore boot code only for Windows XP, Server 2003, Vista, Server 2008 a
    nd Windows 7

    Press any key to quit...
     
  7. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Please, try again and say "Yes" to reboot.
     
  8. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    I did still get the same message. It doesnt reboot. It gives me the same exact message
     
  9. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.
     
  10. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    MBRCheck, version 1.1.0

    (c) 2010, AD



    \\.\C: --> \\.\PhysicalDrive0

    \\.\D: --> \\.\PhysicalDrive0



    Size Device Name MBR Status

    --------------------------------------------

    465 GB \\.\PhysicalDrive0 Unknown MBR code





    Found non-standard or infected MBR.

    Enter 'Y' and hit ENTER for more options, or 'N' to exit:

    Options:

    [1] Dump the MBR of a physical disk to file.

    [2] Restore the MBR of a physical disk with a standard boot code.

    [3] Exit.



    Enter your choice:



    Done! Press ENTER to exit...
     
  11. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Re-run MBRCheck and select option 2.
     
  12. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    ok its asking me to enter a physical disk nmber to fix 0-99?
     
  13. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Enter 0 (zero).
    When done, post resulting log.
     
  14. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    MBRCheck, version 1.1.0
    (c) 2010, AD

    \\.\C: --> \\.\PhysicalDrive0
    \\.\D: --> \\.\PhysicalDrive0

    Size Device Name MBR Status
    --------------------------------------------
    465 GB \\.\PhysicalDrive0 Unknown MBR code


    Found non-standard or infected MBR.
    Enter 'Y' and hit ENTER for more options, or 'N' to exit: y

    Options:
    [1] Dump the MBR of a physical disk to file.
    [2] Restore the MBR of a physical disk with a standard boot code.
    [3] Exit.

    Enter your choice: 2

    Enter the physical disk number to fix (0-99, -1 to cancel): 0
    Available MBR codes:
    [ 0] Default (Windows Vista)
    [ 1] Windows XP
    [ 2] Windows Server 2003
    [ 3] Windows Vista
    [ 4] Windows 2008
    [ 5] Windows 7
    [-1] Cancel

    Please select the MBR code to write to this drive: 0

    Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue: yes
    Successfully wrote new MBR code!
    Please reboot your computer to complete the fix.


    Done! Press ENTER to exit...
     
  15. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    shall i go ahead and reboot?
     
  16. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Please do.
    It looks like MBR isssue has been fixed.
    How are the issues?

    After reboot....

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  17. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    bad news man. The computer wont boot now.
     
  18. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    my buddy cant find his vista disc either (which i keep telling him get rid of vista cause it's garbage) :D
     
  19. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    While running the fix, did you enter correct MBR code?
    3 for Vista

    Just take it easy, no rush. We'll try to fix it.
     
  20. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    i selected 0 (default vista) i thought
     
  21. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    That's fine.

    Let's see, if this will work....

    If you have Vista DVD...

    start with step 2

    If you don't have Vista DVD...

    1. Create Vista Recovery Disc.

    Option 1:
    http://www.c4consulting.com.au/soluctions/vista/VISTA SOLUCTIONS.htm

    Option 2:
    Download Vista Recovery Disc iso image: http://neosmart.net/blog/2008/windows-vista-recovery-disc-download/
    Burn it to CD, or DVD: http://neosmart.net/wiki/display/G/Burning+ISO+Images+to+a+CD+or+DVD

    2. Boot from created disk.
    At first screen click on Repair your computer:
    [​IMG]
    This will bring you to a new screen where the repair process will look for all Windows Vista installations on your computer. When done you will be presented with the System Recovery Options dialog box:
    [​IMG]
    After this, it will present you with a list of options including startup repair, system restore and command prompt:
    [​IMG]
    Select Command Prompt

    Type in:
    bootrec /FixMbr (<--- there is a "space" after "bootrec")
    and then press Enter

    Once completed then type Exit, press Enter and restart computer.
     
  22. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    could we create a bootdisk with that program and rewrite the correct mbr?
     
  23. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    If you follow my instructions, this is exactly what will be done.
     
  24. theRadiantChild

    theRadiantChild TS Enthusiast Topic Starter Posts: 364

    ok I'll have to get back to you tomorrow. I'll keep you posted :)

    thanks!
     
  25. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    No problem. Take your time. When rushing things, mistakes are made.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...