Can I safely delete an infected hidden partition?

Welcome to Major Geeks!

Yes you should be able to delete this partition on the none boot drive with no problem. I can see the below drive and partitions on this additioan drive. The one in red is the infection.

Code:

Size 298.09 GB (320,070,320,640 bytes) 
Partition Disk #0, Partition #0 
Partition Size 298.09 GB (320,070,288,384 bytes) 
[COLOR=red][B]Partition Disk #0, Partition #1 [/B][/COLOR]
[B][COLOR=red]Partition Size 2.48 MB (2,604,544 bytes) [/COLOR][/B]

We would normally use G-Parted as described in the below link to do this:

Using G-Parted to Repair Windows Partition Infections

You would not need to run the final steps of fixmbr and fixboot since this is not your boot drive. You have more to do than deleting this partition though. You have infections on your D drive which you need to remove. You need to run ComboFix as requested and attach the log so that we can continue to repair your problems. It would be good to delete the infected partition first though.

 

Now download The Avenger by Swandog46, and save it to your Desktop.


See the download links under this icon

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).



Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

While it is not impossible that this is a malware related problem, I would say it is unliklely to be caused by malware. We have never seen any malware that picks a particular time of time like this to start causing a networking problem. In addition, if it were malware, it is also extremely unlikely that it would only impact your wireless connection.

If your other PCs are actually running AT THE EXACT SAME TIME and have been on for the SAME LENGTH OF TIME, and they do not have this problem, then it would seem more likely that you are either running something on this PC that is causing an issue at this time of day. For example you have all of the below tasks set to run. What time do the run?

Code:

"D:\WINDOWS\Tasks\"
ad0ed9~1.job  24 Feb 2012         486  "Ad-Aware Update (Weekly).job"
apples~1.job  22 Feb 2012         284  "AppleSoftwareUpdate.job"
asc5_a~1.job  24 Feb 2012         300  "ASC5_AutoClean.job"
asc5_a~3.job  23 Feb 2012         302  "ASC5_AutoUpdate.job"
dailyb~1.job  24 Feb 2012         938  "Daily backup.job"
google~1.job  24 Feb 2012         890  "GoogleUpdateTaskMachineCore.job"
google~2.job  24 Feb 2012         894  "GoogleUpdateTaskMachineUA.job"

Or this PC is actually having some physical issue with the wireless network card.


Run a scan with MGtools at the exact time when the problem is occurring. Then afterwards, try the below steps one at a time and tell me if the problem clears up.

• Power cycle your cable, DSL, or FIOS modem ( whatever you have )
• Power cycle your router that provides wireless capability if not provided by the above mentioned modem.
• If the above have no effect, power down this PC for about 2 minutes then power it back up and see if the problem is still happening.

 

I doubt that would change anything. This problem with time of day is not symptomatic of a problem with your drivers. It is more symptomatic of a hardware issue like heating, network interference at time of day, or with some other piece of software running on your PC some how causing a problem during this time.

Let's do a couple more scans before totally ruling out malware.

Run GMER per the below and attach the log:

GMER - running with a random name

Please download OTL by OldTimer.

• Save it to your desktop.
• Double click on the OTL icon on your desktop. (If running Vista or Win7 right-click and select Run as Administrator)
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the Customs Scans/Fixes text-field.
  
  Code:

  netsvcs
  /md5start
  afd.sys
  atapi.sys
  csrss.exe
  dhcpcsvc.dll
  explorer.exe
  lsass.exe
  nsiproxy.sys
  regedit.exe
  services.exe
  svchost.exe
  tcpip.sys
  tdx.sys
  userinit.exe
  winlogon.exe
  /md5stop
  %systemdrive%\*.*
  %systemdrive%\MGtools\*.*
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.sys /90
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %windir%\assembly\GAC\*.ini
  %windir%\assembly\GAC_MSIL\*.ini
  %windir%\assembly\gac_32\*.ini
  %windir%\assembly\gac_64\*.ini
  %windir%\assembly\temp\*.ini
  %windir%\assembly\tmp\u /s
  %allusersprofile%\application data\*.exe
  hklm\system\currentcontrolset\services\dhcp
  hklm\system\currentcontrolset\services\afd
  hklm\system\currentcontrolset\services\tdx
  hklm\system\currentcontrolset\services\tcpip
  hklm\system\currentcontrolset\services\nsiproxy
  hklm\software\microsoft\windows\currentversion\run
  hklm\software\microsoft\windows\currentversion\runonce
  

• Now click the Run Scan button.
• Two reports will be created:
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized
• Attach both OTL.txt and Extras.txt to your next message. (See how to attach)

 

That is not what it removed because that is not a valid registry key. What you probably meant was the below which I saw in your logs and ignored because it is not a problem.

Many people manipulate this regstry entry in an attempt to improve or performance with P2P/torrent downloading type applications. Then there are also people like you ( or some one else in your family using this PC ) who are playing games ( and you have a lot ). And you tweak this to improve game performance.

This is more likely where the fix came. You probably removed some settings that the family "gamer" tweaked to allow port related settings to be open towards this PC for game playing. And perhaps the late night gamers in the world were trying to access some game related stuff on your PC for online game playing.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!