Possible Malware infection

Se our instructions again. Also scan should only be run once! Also you were not supposed to do anything but scan with RogueKiller. No fixing/deleting!

Your logs are clean but one thing is questionable and that is the below 3GB partition

Code:

Partition Disk #0, Partition #2 
Partition Size 3.65 GB (3,915,233,280 bytes) 
Partition Starting Offset 246,075,701,760 bytes 

Do you know what this is? Does it contain any info that you put there?


Goto the below link and follow the instructions for running TDSSKiller from Kaspersky

• TDSSkiller - How to run

• Be sure to attach your log from TDSSKiller

Now please also download MBRCheck to your desktop.

See the download links under this icon

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

 

Okay well it may be an issue. TDSSKiller also pointed to it ( somewhat indirectly ) with the below

Code:

11:55:00.0314 5720 \Device\Harddisk0\DR0\# - copied to quarantine
11:55:00.0314 5720 \Device\Harddisk0\DR0 - copied to quarantine
11:55:00.0361 5720 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - will be cured on reboot
11:55:00.0376 5720 \Device\Harddisk0\DR0 - ok
11:55:00.0376 5720 \Device\Harddisk0\DR0 ( Rootkit.Boot.Sinowal.b ) - User select action: Cure 

Rerun TDSSkiller again and attach a new log. I want to make sure this has gone away before deciding whether to take any action on that partition.

 

Looks good!

Not really.

It does seem questionable and it does not look like a recovery partition. Your logs showed the below three partitions:

Code:

Partition Disk #0, Partition #0 
Partition Size 47.03 MB (49,319,424 bytes) 
 
Partition Disk #0, Partition #1 
Partition Size 229.13 GB (246,026,350,080 bytes) 
 
Partition Disk #0, Partition #2 
Partition Size 3.65 GB (3,915,233,280 bytes) 
 

And partition information also showed the below

Code:

  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    OEM                 47 MB    32 KB
  Partition 2    Primary            229 GB    47 MB
  Partition 3    Unknown           3734 MB   229 GB

The OEM partition would more likely be a recovery partition from Dell.

However I cannot say for sure whether the last 3.7 GB partition is a problem. Are you currently having any more malware issues of any kind? If your answer is yes, then the only thing left to try may be removing this partition.

 

Doubt this would be a problem related to the partition. Sounds more like your router has a problem. Wyy don't you try bypassing the router and connect direct to your cable, or FiOS....etc mode and run this way for an interval ( whatever it normally takes ) to test if it is just your router.

It is not the MBR. It is a partition which is an even lower level. Rewriting an MBR or even formatting a drive does not fix a partition problem. You have to work on the partition itself. If you are not having any real malware problems ( and it does not seem so ) I would leave the partition alone. It is possible that Dell put a factory recovery partition there and did not label the partition.

 

If you want to determine whether the router is the cause of your problems, you need to try it.

Not true at all. Your router would not block outgoing things from your PC. This is why software firewalls need to be installed on your PC as stated in our How to Protect yourself from malware!
sticky.

No! As already stated. Infected partitions need to be deleted using special partition editing software which in most cases will not cause any loss of data. Other alternatives would be to use your Windows Boot CD to erase all partitions. Create new partitions. Format them. And then reinstall everything from scractch. Obviously this second option wipes out everything on your PC.

No! It is either an infected partition added by the malware or it is a factory recovery partition added by Dell. Since it is not labeled, we cannot tell. Do you know if Dell installed a Factory Recovery partition? Ask them. This is why it is preferential to bypass your router first rather than deleting this partition first.

No!

 

Your logs have been clean since TDSSkiller removed the Rootkit.Boot.Sinowal.b infection.

If you are not having any other malware problems, it is time to do our final steps and you can test bypassing your router.

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Press and hold the Windows key and then press the letter R on your keyboard. This opens the Run dialog box.
   • Copy and paste the below into the Run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!