Black Internet Virus

Nessa · Jul 13, 2010

Hi! This is my first time using this forum so my apologies if I'm slow to follow on something. Please keep in mind I'm not a computer wizard so I may be a bit slow.

I'm pretty sure I have the Black Internet Virus.

My avast located it to the System Volume information folder where I believe it's in smss.exe and services.exe. When I even open up the Microsoft sub-folder containing them avast goes off.

What it does to my computer is:
1) Brings the "wave" bar on my master volume to zero, muting my sound.
2) Opens random Explorer pages when my default is Mozilla.
3) Random sounds.

I read on another thread that a program called Bootkit Remover could fix this thing, but when I downloaded it and tried to open it, a message pops up and says "Invalid Menu Handle."

How do I fix this?

chaslang · Jul 13, 2010

Welcome to Major Geeks!

Your infection is in your Master Boot Record (MBR). We need to see the below log before creating a fix.

Download bootkit_remover.rar

Click the underlined DOWNLOAD text to download the file and save it to your Desktop.

You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip

After extracing remover.exe to your Desktop, double click the remover.exe file to run the program.

Attach or post inline here, the output from remover.exe

NOTE: The Command Prompt window text can be copied to the clip board by right clicking on the top bar of the window and using the Edit commands to Mark, Copy, and Paste.

Even if you still get an error with the above, continue on with the below and answer all questions to the best of your ability.

Also I need to ask some questions:

Do you have any drives that has a non-windows installation on them

Are all drives NTFS formatted

Do you have any non-standard or special MBRs which can occur from companies like Dell or HP who frequently install additional partitions used for recovery partitions in lieu of giving CD/DVDs.

Is any program like Grub ( see:http://www.gnu.org/software/grub/ ) being used

Is drive-encryption being used?

Are any drives external USB pen drives or external hard drives being used?

VERY IMPORTANT: Do you have all important data backed up? You really should do this before continuing since we will need to rewrite your MBR to fix this and while most times this can be done without any problem, these infections can react badly and that could result in a PC not being bootable. You really don't have much choice though since these infections are too dangerous to your security to leave on a PC.

Now follow the directions in the below link for running MGtools It also explains possible reasons for not being able to run MGtools

Using MGtools

Attach the requested MGlogs.zip file.

Nessa · Jul 13, 2010

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive0
MD5: ae0547f400cf43be74a75ac1f529d1c0
\\.\G: -> \\.\PhysicalDrive0

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>

Press any key to quit...

chaslang · Jul 13, 2010

You have 7 questions to answer and you need to attach the log from MGtools.

Log in or Sign up

Black Internet Virus

Nessa Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Nessa Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member