Virus/Trojan? Toolbar hidden, internet access disabled, can't run virus scans or malware detectors

If your laptop is infected to a point where the OS is untrustable, then I'd recommend using a WindowsPE bootable USB disk to boot with and then loading anti-virus/malware software scanners from it instead. There are viruses and malware that can do what you're talking about, and if you are indeed infected, then even trying to boot into safemode might not correct your problems.

As a security expert, my personal suggestion would be to create a WindowsPE disk and copy your absolute necessary files to the USB only and reformat the hard drive. Once a system has been compromised even the best virus scanners in the world can be fooled and allow for backdoors to stille exist. The only way to be sure your system is clean is to save your data and start over.

You really should back up your data before you do anything.

What you can do is download Malwarebytes' Anti-Malware (as already suggested by blacflame) from another computer and download it onto a usb flash drive and run it from there. http://www.malwarebytes.org/mbam.php

You'll might need to rename the file before saving to your desktop so it will not be blocked.

Malwarebytes' Anti-Malware is NOT designed to be ran in Safe Mode. Unless it's your last resort.

Yep, I have tried scanning and booting in safe mode but the scans still do not work. As far as backing up my data, I really wish I could. The "infection" does not let me move files from my hard drive to my USB which is one reason this is so urgent. Just for kicks, I even tried to see if I could system restore and restore to factory condition. It does not let me do either as it tells me that "it will not fix my system."

Also, I have installed several scans and malware scanners per JeremySBrown's method, but the scans still will either not run or not finish. I will try the mbam program though and report back.

What is a WindowsPE bootable disk? Is this the disk that is can be made to restore your system? (dumb question I know)

Thanks for all the suggestions so far.

Hi god_flame,

Have you tried an online scanner?
http://www.pandasecurity.com/usa/homeusers/solutions/activescan/

Just tried the mbam program and it doesn't work on my computer. Keeps telling me several files are outdated.

I found a PE disk maker program on the major geeks link

Wish I could do the online scanner but my infected computer's internet access has been disabled by the virus.

Oop, I forgot about the internet.

Try using a RescueDisk from Kaspersky.
http://devbuilds.kaspersky-labs.com/devbuilds/RescueDisk/

Using another pc to download the tool into a USB, please download ComboFix by sUBs: Rename the file into something else like CF.exe or CF.com before downloading.
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

And scan the infected system with it and show us the resulting log.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Well, rpggamergirl, I think i'm in deep trouble. I ran the combofix scan and it told me that "rootkey activity was detected" and that the "system file is infected." Unfortunately, just like my virus scans, it didn't generate a list for me. It attempted to restore my system file but it had no effect. So I don't know how to get you guys the necessary list.

Also, it says that my "Microsoft Windows recovery console" is not installed and that it won't fix my serious infections. It says I can download it, but my internet is disabled. I fear that I may be stuck in the loop of death.

Create a CD with the PE disk maker program you found on the major geeks link.
Attach your USB drive then boot your laptop from the PE CD.
Copy your data to the USB drive.

Please run Combofix again but this time you need to let combofix  install the Recovery Console.
Once the Recovery Console is installed, Combofix will remove that rootkit. Show us the log too.
There are cases where if a rootkit is detected Combofix will not attemp to remove it unless a Recovery Console is installed.

So that's what you need to do, install the Recovery Console when Combofix asks you to.

That's the problem though. I can't install the recovery console because I do not have internet on the infected computer. The infection has disabled it :(

I have been attempting the PE method, hasn't worked yet but it seems more promising so far.

Did you try using the rescuedisk from Kaspersky?

<<<"I can't install the recovery console because I do not have internet on the infected computer. The infection has disabled it :( ">>>

If you have your Windows CD, here's the instructions on how to install the Recovery Console:(You don't need to use the Recovery Console, just install it)
http://www.bleepingcomputer.com/tutorials/tutorial117.html


If you do not have the Windows CD, you can download the file from Microsoft using another pc and and we can let Combofix install it. Let us know.

I've been messing with Kapersky for about the last 5 hours. The disk isn't detected at bootup on my infected or my good computer. I think something is up with the iso file. I will download the recovery console file from microsoft and give it a shot. Thanks!

god_flame,

<The disk isn't detected at bootup on my infected or my good computer. I think something is up with the iso file.>

Make sure that you go in the BIOS and set your CD-ROM to 1 in the boot device settings.

What program are you using to burn the .iso image?

I can't find the file I need to download to install the recovery console. Anyone have the link?

I am using Nero to burn the iso. I'm new to Nero so I may have burned it wrong. I burned it as a Data CD.

In Nero, select File, and select Burn Image... Nero will prompt you to choose a image file to burn, select the Kaspersky RescueDisk .iso image.

Cool, will try again. Thanks.

Are you following JeremySBrown's KAS suggestion?

or do you mean the MS file to install the Recovery Console that I asked?
If you're doing my suggestions then here are the links to the file: Combofix.exe and the downloaded MS file must both be on the same location e.g. desktop for Combofix to install it.

XP Home SP2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=15491F07-99F7-4A2D-983D-81C2137FF464&displaylang=en

XP Pro SP2:
http://www.microsoft.com/downloads/details.aspx?FamilyId=535D248D-5E10-49B5-B80C-0A0205368124&displaylang=en

Kapersky is running! WIll let you know the results.

Yet another problem...Kapersky ran, but it finished scanning my C drive in about 2 minutes and didn't find anything. I also says my databases are obsolete and I don't have any way of updating since internet doesn't work. I had hope :(

back to combofix

Sorry for all the annoying updates...but I just found out the the Kapersky program may have renamed my drives. My C:/ became my CD drive and my D:/ became my hard drive. Now I am scanning my D:/ and it is taking much longer. It's about halfway done.

Kaspersky finished and didn't find anything! :(

Just as well it didn't find and remove it, it could've been worse....you took a big risk there, as we know there usually is a certain amount of risk when removing infection while Windows is not active, in this case the risk is much higher that's why Combofix here did not attempt to clean the system unless RC is installed for safety net.

Try and install RC, so then Combofix will attempt to remove the rootkit.

god_flame,

At this stage, I would definitely listen to rpggamergirl's suggestion and try to install RC, so Combofix can remove the infection(s.)

Ok here's the problem now. I don't have a floppy drive to make the recovery console diskettes and I don't have the XP CD. I managed to create a bootable recovery console CD though. The problem is that I have tried rpggamergirl's suggestion to have the recovery file and the combofix in the same location, but that is impossible for me to do. Remember I cannot copy, cut, or paste anything. The best I could do was make desktop shortcuts. Combofix did not detect the file and the recovery console is still not installed. In order to actually INSTALL the RC I need a windows xp cd. I've done some research and as long as I have the XP CD I can just run (CD drive):/i386/WinNT32.exe\cmdcons. I cannot find any other way around this. I've been trying all night.

Another thing you might want to try is this.

Take the hard drive out of your laptop and use a SATA/ IDE to USB 2.0 adapter.

http://www.newegg.com/Product/Product.aspx?Item=N82E16812232002

Once you have your laptop hard drive connected using this or a similar adapter to another laptop or desktop, scan your drive again, or even better, backup your data and information.

Wait for rpggamergirl's suggestion before taking my suggestion, she might have a solution to the problem your having now.

Regarding ID:25595249

1-If booted to Knoppix, and you have a usb drive, you can back your data up (as mentioned)

2-Also if you have the recovery console file on that usb drive, you can transfer it to your desktop, along with whatever else is needed, through knoppix.

If you try "2" and booted into knoppix you should see a hard disk + usb disk icon on the desktop.
Right click on them (individually) and select "Change read/write mode" and click ok---This allows "write" access.
You can then transfer files visa-versa.

Vice-Versa(damn typing skills!)

I got all of my important files through Knoppix. THANK YOU!!! Now, as far as being able to run CF, am I running it through knoppix after I transfer them both to the same location? Or will the files appear on my desktop doing my normal boot up and then run it through XP?

Is the file that creates the bootdisks for the RC the same thing as the RC file? If it is they are in the same location and it didn't work. If it is not, then I have no other ideas on how to get this file without the CD.

Unfortunately, I wouldnt be too familier with the workings of RC file being intergrated with Cf.

In this case you would only use Knoppix's interface to browse through your hard drive to copy files --->
--->In knoppix, open up hard disk icon and browse to :
 Documents and Settings\"your_user_name"\Desktop

Thats where you would copy your files to, so when you boot back into windows, the files are on your desktop.

If you have done that and it didn't work try Superantispyware.
Rename superantispyware to something else like asy.exe, prior to transferring it to the infected machine:

Superantispyware http://www.superantispyware.com/
Its offline defination updates http://www.superantispyware.com/definitions.html

<<<"Remember I cannot copy, cut, or paste anything.">>>


Once you have put the MS setup file that I asked you to download on the desktop or in the same location as Combofix, all you have to do is drag and drop(unless you can't drag and drop) the MS file into Combofix.exe icon and Combofix will install the RC and then scan the system.
After you dropped the MS file into Combofix icon, just follow the prompts Combofix will do the rest.

# Drag the setup package onto ComboFix.exe and drop it, and follow the prompts.

Sorry I missed that drag and drop part, i didn't read it carefully enough. Unfortunately I am not able to drag and drop either. Tried it through knoppix and couldn't do it either.

As for Superspyware and any other similar program, I can't run because it says "I may not have permission." Which I do have permission of course.

If there is a way to merge these do files in the command prompt, it may work. My command prompt and the windows "run" seem to be the only two things that work on my computer.

*two file, not "do" :P

Hey all, well, I finally gave in. The important thing is that I was able to get the files I needed. I'm reformatting right now and I had to go out and buy windows vista. Since I'm a student it was only $15 for me. THANK YOU EVERYONE! Hopefully this will work. If it doesn't, new pc time...