Solved

Bad Virus

Posted on 2010-09-24
15
519 Views
Last Modified: 2012-05-10
I have a bad virus on a pc here.

I cannot boot to safe mode. Each time i try i get what seems like a bsod, but if i turn off auto shutdown on system failure, i still get no BSOD, and the pc just reboots.

In regular mode i have..
Ran Combo Fix
Ran Malwarebytes
Ran Hijack This
Ran SmitFraud Fix
Ran rKill
Kaspersky AV

No matter what the Virus Returns after reboot of KAV scan. Each time i run Combo Fix it detects a root kit. It reboots, and combo fix continues. It eventually finishes. If i run it again i once again get Rootkit, and it reboots. I figured system restore was fucking with it.
So i try to cut it off. Each time i cut it off windows won't boot, then after it restarts, it will boot and system restore is on.

Any ideas guys?

Also OS is XP
0
Comment
Question by:STS-Tech
15 Comments
 
LVL 11

Expert Comment

by:ProfessorBindokas
ID: 33753132
Hi, what is the name of the virus (which particular rootkit) that is being detected?
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753166
Hello,

Use ultimate boot CD or connect that hard drive to another computer which is not infected & with updated antivirus.

Scan whole system.Remove viruses from computer & then check.
   
In my opinion, take data backup & reinstall windows XP. Because this process will take lot of time.

Regards,
Tushar Kaskhedikar  
0
 
LVL 2

Author Comment

by:STS-Tech
ID: 33753203
Ok i'll try my UBCD after what i'm attempting now, and i will get you the name after it is over, as of now i'm trying to be sneaky...

I booted, ran smitfraud, ran mbam which found 1 infected, i did not reboot when prompted, i created a system restore point. I ran combo fix, when i was prompted with Rootkit, i used task manager to open run, and ran system restore, and made another new point. Then i cut off system restore. I said ok to combo fix to reboot the pc, when it booted to combo fix removing, i started the task manager, went to run, ran rkill to stop anything from trying, then mbam, started a scan, and combo fix was still running, i hope this is get this sucker.
0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753301
Hello,

Take data on another partition or on external drive. Reinstall Windows XP.Or check with antivirus sites if any virus removal tools & run it & scan the system.

Regards,
Tushar Kaskhedikar
0
 
LVL 2

Author Comment

by:STS-Tech
ID: 33753334
No go still, the virus being detected is...
MEM:Rootkit.win32.tdss.f
0
 
LVL 19

Expert Comment

by:*** Hopeleonie ***
ID: 33753376
These tool will help you to clean!
Run:
- Drweb Cureit

The link you will find here:
http://www.experts-exchange.com/blogs/hopeleonie/B_2335-Malware-Removal-Links-all-for-free.html
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753467
Hello,

Virus has been enter the system files, windows files. In my opinion, please reinstall windows XP.This

Regards,
Tushar Kaskhedikar  
0
 
LVL 2

Accepted Solution

by:
STS-Tech earned 0 total points
ID: 33753477
Ah i got it guys thanks!

Here is a nice free tool from KAV because they are amazing.

http://www.computing.net/answers/security/remove-rootkitwin32tdssd/30477.html?SID=e48tpccp9b&dr_log=-1&linkout=http%3A//support.kaspersky.com/downloads/utils/tdsskiller.zip

I ran that and now i am fine.
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753648
Hello,
 
I already told you that please check with your antivirus web site. If there is any removal tool.
Then why are you accepted this answer himself?

Regards,
Tushar Kaskhedikar  
0
 
LVL 27

Expert Comment

by:Thomas Zucker-Scharff
ID: 33753940
Note that once you have a rootkit, your best bet is to do a complete backup and wipe your disk then reinstall windows.  Although there are many rootkit removers, you never know what has been left behind.  You can download the free vmplayer and create a virtual machine in which you do all your browsing and connecting to internet.  If the VM gets infected you just erase it and the infection is gone.

For more about rootkits:

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/A_2245-Anti-rootkit-software.html
0
 
LVL 2

Author Closing Comment

by:STS-Tech
ID: 33754068
See my Answer
0
 
LVL 2

Author Comment

by:STS-Tech
ID: 33755786
Please Split between the two
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It’s the first day of March, the weather is starting to warm up and the excitement of the upcoming St. Patrick’s Day holiday can be felt throughout the world.
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question