IE pop ups, wave sound level muting, random sounds playing

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by jld234, Jul 13, 2010.

  1. jld234

    jld234 Private E-2

    I've got the same virus a lot of people seem to have right now. I looked through these other threads and couldn't seem to find an answer so I thought I'd post some info that was requested of someone else with this problem and see if anyone might be able to help me.

    I downloaded the Bootkit Remove and it spit out this info:

    Bootkit Remover version 1.0.0.1
    (c) 2009 eSage Lab
    www.esagelab.com

    \\.\C: -> \\.\PhysicalDrive0
    MD5: b19ee33a0168d5f0bb9afbe12e2bc035
    CreateFile() ERROR 5

    Size Device Name MBR Status
    --------------------------------------------
    74 GB \\.\PhysicalDrive0 Unknown boot code

    Unknown boot code has been found on some of your physical disks.
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>


    Press any key to quit...


    Other possibly helpful info:
    - I do not have drives with non-windows installation
    - I have Windows XP and believe my drives are all NTFS formatted
    - I have a Dell Latitude D620 and am not sure if that means I have a non-standard MBR.
    - No Grub software
    - no external hard drives
    - do not currently have data backed up but could probably try to rectify that since, duh, i should do that anyway.

    MGLogs File attached.

    PLEASE HELP!!
     

    Attached Files:

    jld234, Jul 13, 2010
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Do you have all important data backed up? You really should do this before continuing since we will need to rewrite your MBR to fix this and while most times this can be done without any problem, these infections can react badly and that could result in a PC not being bootable. You really don't have much choice though since these infections are too dangerous to your security to leave on a PC.

    Now - please do the following:

    • Click Start, Run then copy and paste the below into the Run box and click OK.

    "%userprofile%\Desktop\remover.exe" fix \\.\PhysicalDrive0

    • Now reboot your PC and after reboot continue with the below instructions.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    • C:\MGlogs.zip


    Make sure you tell me how things are working now!
     
    TimW, Jul 14, 2010
    #2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds