Solved

Bad Virus

Posted on 2010-09-24
15
513 Views
Last Modified: 2012-05-10
I have a bad virus on a pc here.

I cannot boot to safe mode. Each time i try i get what seems like a bsod, but if i turn off auto shutdown on system failure, i still get no BSOD, and the pc just reboots.

In regular mode i have..
Ran Combo Fix
Ran Malwarebytes
Ran Hijack This
Ran SmitFraud Fix
Ran rKill
Kaspersky AV

No matter what the Virus Returns after reboot of KAV scan. Each time i run Combo Fix it detects a root kit. It reboots, and combo fix continues. It eventually finishes. If i run it again i once again get Rootkit, and it reboots. I figured system restore was fucking with it.
So i try to cut it off. Each time i cut it off windows won't boot, then after it restarts, it will boot and system restore is on.

Any ideas guys?

Also OS is XP
0
Comment
Question by:STS-Tech
15 Comments
 
LVL 11

Expert Comment

by:ProfessorBindokas
ID: 33753132
Hi, what is the name of the virus (which particular rootkit) that is being detected?
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753166
Hello,

Use ultimate boot CD or connect that hard drive to another computer which is not infected & with updated antivirus.

Scan whole system.Remove viruses from computer & then check.
   
In my opinion, take data backup & reinstall windows XP. Because this process will take lot of time.

Regards,
Tushar Kaskhedikar  
0
 
LVL 2

Author Comment

by:STS-Tech
ID: 33753203
Ok i'll try my UBCD after what i'm attempting now, and i will get you the name after it is over, as of now i'm trying to be sneaky...

I booted, ran smitfraud, ran mbam which found 1 infected, i did not reboot when prompted, i created a system restore point. I ran combo fix, when i was prompted with Rootkit, i used task manager to open run, and ran system restore, and made another new point. Then i cut off system restore. I said ok to combo fix to reboot the pc, when it booted to combo fix removing, i started the task manager, went to run, ran rkill to stop anything from trying, then mbam, started a scan, and combo fix was still running, i hope this is get this sucker.
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753301
Hello,

Take data on another partition or on external drive. Reinstall Windows XP.Or check with antivirus sites if any virus removal tools & run it & scan the system.

Regards,
Tushar Kaskhedikar
0
 
LVL 2

Author Comment

by:STS-Tech
ID: 33753334
No go still, the virus being detected is...
MEM:Rootkit.win32.tdss.f
0
 
LVL 18

Expert Comment

by:hopeleonie
ID: 33753376
These tool will help you to clean!
Run:
- Drweb Cureit

The link you will find here:
http://www.experts-exchange.com/blogs/hopeleonie/B_2335-Malware-Removal-Links-all-for-free.html
0
Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753467
Hello,

Virus has been enter the system files, windows files. In my opinion, please reinstall windows XP.This

Regards,
Tushar Kaskhedikar  
0
 
LVL 2

Accepted Solution

by:
STS-Tech earned 0 total points
ID: 33753477
Ah i got it guys thanks!

Here is a nice free tool from KAV because they are amazing.

http://www.computing.net/answers/security/remove-rootkitwin32tdssd/30477.html?SID=e48tpccp9b&dr_log=-1&linkout=http%3A//support.kaspersky.com/downloads/utils/tdsskiller.zip

I ran that and now i am fine.
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753648
Hello,
 
I already told you that please check with your antivirus web site. If there is any removal tool.
Then why are you accepted this answer himself?

Regards,
Tushar Kaskhedikar  
0
 
LVL 26

Expert Comment

by:Thomas Zucker-Scharff
ID: 33753940
Note that once you have a rootkit, your best bet is to do a complete backup and wipe your disk then reinstall windows.  Although there are many rootkit removers, you never know what has been left behind.  You can download the free vmplayer and create a virtual machine in which you do all your browsing and connecting to internet.  If the VM gets infected you just erase it and the infection is gone.

For more about rootkits:

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/A_2245-Anti-rootkit-software.html
0
 
LVL 2

Author Closing Comment

by:STS-Tech
ID: 33754068
See my Answer
0
 
LVL 2

Author Comment

by:STS-Tech
ID: 33755786
Please Split between the two
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

Healthcare organizations in the United States must adhere to the guidance of both the HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health Act) for securing and protec…
Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now