Solved

Bad Virus

Posted on 2010-09-24
15
520 Views
Last Modified: 2012-05-10
I have a bad virus on a pc here.

I cannot boot to safe mode. Each time i try i get what seems like a bsod, but if i turn off auto shutdown on system failure, i still get no BSOD, and the pc just reboots.

In regular mode i have..
Ran Combo Fix
Ran Malwarebytes
Ran Hijack This
Ran SmitFraud Fix
Ran rKill
Kaspersky AV

No matter what the Virus Returns after reboot of KAV scan. Each time i run Combo Fix it detects a root kit. It reboots, and combo fix continues. It eventually finishes. If i run it again i once again get Rootkit, and it reboots. I figured system restore was fucking with it.
So i try to cut it off. Each time i cut it off windows won't boot, then after it restarts, it will boot and system restore is on.

Any ideas guys?

Also OS is XP
0
Comment
Question by:STS-Tech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
15 Comments
 
LVL 11

Expert Comment

by:ProfessorBindokas
ID: 33753132
Hi, what is the name of the virus (which particular rootkit) that is being detected?
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753166
Hello,

Use ultimate boot CD or connect that hard drive to another computer which is not infected & with updated antivirus.

Scan whole system.Remove viruses from computer & then check.
   
In my opinion, take data backup & reinstall windows XP. Because this process will take lot of time.

Regards,
Tushar Kaskhedikar  
0
 
LVL 2

Author Comment

by:STS-Tech
ID: 33753203
Ok i'll try my UBCD after what i'm attempting now, and i will get you the name after it is over, as of now i'm trying to be sneaky...

I booted, ran smitfraud, ran mbam which found 1 infected, i did not reboot when prompted, i created a system restore point. I ran combo fix, when i was prompted with Rootkit, i used task manager to open run, and ran system restore, and made another new point. Then i cut off system restore. I said ok to combo fix to reboot the pc, when it booted to combo fix removing, i started the task manager, went to run, ran rkill to stop anything from trying, then mbam, started a scan, and combo fix was still running, i hope this is get this sucker.
0
Now Available: Firebox Cloud for AWS and FireboxV

Firebox Cloud brings the protection of WatchGuard’s leading Firebox UTM appliances to public cloud environments. It enables organizations to extend their security perimeter to protect business-critical assets in Amazon Web Services (AWS).

 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753301
Hello,

Take data on another partition or on external drive. Reinstall Windows XP.Or check with antivirus sites if any virus removal tools & run it & scan the system.

Regards,
Tushar Kaskhedikar
0
 
LVL 2

Author Comment

by:STS-Tech
ID: 33753334
No go still, the virus being detected is...
MEM:Rootkit.win32.tdss.f
0
 
LVL 19

Expert Comment

by:*** Hopeleonie ***
ID: 33753376
These tool will help you to clean!
Run:
- Drweb Cureit

The link you will find here:
http://www.experts-exchange.com/blogs/hopeleonie/B_2335-Malware-Removal-Links-all-for-free.html
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753467
Hello,

Virus has been enter the system files, windows files. In my opinion, please reinstall windows XP.This

Regards,
Tushar Kaskhedikar  
0
 
LVL 2

Accepted Solution

by:
STS-Tech earned 0 total points
ID: 33753477
Ah i got it guys thanks!

Here is a nice free tool from KAV because they are amazing.

http://www.computing.net/answers/security/remove-rootkitwin32tdssd/30477.html?SID=e48tpccp9b&dr_log=-1&linkout=http%3A//support.kaspersky.com/downloads/utils/tdsskiller.zip

I ran that and now i am fine.
0
 
LVL 11

Expert Comment

by:kaskhedikar_tushar
ID: 33753648
Hello,
 
I already told you that please check with your antivirus web site. If there is any removal tool.
Then why are you accepted this answer himself?

Regards,
Tushar Kaskhedikar  
0
 
LVL 27

Expert Comment

by:Thomas Zucker-Scharff
ID: 33753940
Note that once you have a rootkit, your best bet is to do a complete backup and wipe your disk then reinstall windows.  Although there are many rootkit removers, you never know what has been left behind.  You can download the free vmplayer and create a virtual machine in which you do all your browsing and connecting to internet.  If the VM gets infected you just erase it and the infection is gone.

For more about rootkits:

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/A_2245-Anti-rootkit-software.html
0
 
LVL 2

Author Closing Comment

by:STS-Tech
ID: 33754068
See my Answer
0
 
LVL 2

Author Comment

by:STS-Tech
ID: 33755786
Please Split between the two
0

Featured Post

Secure Your Active Directory - April 20, 2017

Active Directory plays a critical role in your company’s IT infrastructure and keeping it secure in today’s hacker-infested world is a must.
Microsoft published 300+ pages of guidance, but who has the time, money, and resources to implement? Register now to find an easier way.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Top honey pots & reviews of canary 7 58
PGP software 3 45
security group 2 25
How do I restrict certain programs? 9 42
If you are looking at this article, you have most likely been hit by some version of ransomware and are trying to find out if there is anything you can do, or what way you should react - READ ON!
Smart phones, smart watches, Bluetooth-connected devices—the IoT is all around us. In this article, we take a look at the security implications of our highly connected world.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question