Help with Black Internet trojan (iv)

Rosendal · Jun 28, 2010

Hello, everybody.

I've been wrestling with a couple of Black Internet trojans in the last couple of days (from the 26th), just like the guy in http://forums.majorgeeks.com/showthread.php?p=1502890 and other threads, except that I use Vista.

I have run remover.exe with the output,

Bootkit Remover version 1.0.0.1
(c) 2009 eSage Lab
www.esagelab.com

\\.\C: -> \\.\PhysicalDrive0
MD5: 33651d4929a84a7ab9d65c115ce1bdc0
\\.\D: -> \\.\PhysicalDrive0

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>

Press any key to quit...

and I have run MGtools, logfile is attached.

I have one physical harddisk with two partitions on it, and all my data is backed up.

Thanks in advance for the help

Rosendal

Kestrel13! · Jun 28, 2010

Try to be in normal mode now when we complete the below.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O15 - Trusted Zone: http://*.danid.dk (HKLM)
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone
Click to expand...

After clicking Fix exit HJT.

Please go to Add/Remove programs and uninstall the following software:

Java(TM) 6 Update 17

Java(TM) 6 Update 4

Java(TM) SE Development Kit 6 Update 4

Now reboot your machine and install the most current and up to date version of Java available here at the below link:

Java Runtime 6

Next...

Click Start, Run and copy and paste the below into the Run box and click OK.

"%userprofile%\Desktop\remover.exe" fix \\.\PhysicalDrive0
Click to expand...

Now reboot your PC and after reboot continue with the below instructions.

Run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

C:\MGlogs.zip

Make sure you tell me how things are working now!

Rosendal · Jun 28, 2010

Hey, thanks for the attempt, but apparently something was messed up from my side which made the computer completely abandon ship and give up on me, and now I can't access Windows at all.

I'll try my luck with a reinstallation, and go to the proper subforum if I need help with something connected with that

Kestrel13! · Jun 28, 2010

OK, well just post back if you decide not to reinstall after all.

Log in or Sign up

Help with Black Internet trojan (iv)

Rosendal Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Rosendal Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member