Possible swr_wizard.exe infection

karendanette · Apr 25, 2009

Hi,

I'm trying to repair my daughter's Compaq pc. I have followed to the best of my ability all of the steps, only in safe mode because of the length of time it takes the virus to load on startup in normal mode. I had done a system recovery a month ago only to realize when I came back three weeks later that the system recovery did not work. Following your instructions allowed me to remove 47 infected files with Malware Bytes and Super AntiSpyware.

When I brought the pc home in order to devote more time, again following instructions 216 infected files were removed. There was still a problem. There were locked files and using Malware bytes, I was able to unlock/delete the old user files, then using the same process, unlock the recycler to get rid of 14 more infected files. There was still a problem.

At this point, I again did a system recovery. This time it appeared to work except that I was receiving suspicious security warnings saying that Avast was not up to date, no firewall, and even one from Avast saying I was not using the current VPS. When I would right click Avast and manually update, I was told it was up to date.

Today I uninstalled and reinstalled Avast. On running a boot time scan, the following two infected files were found:
c:\hp\recovery\wizard\swr_wizard.exe - infected with win32:trojan-gen.
c:\system volume information\_restore {xxxxxxxxxxx}\rp15\a007580.exe was infected. As it was a boot time scan, I had it delete the files.

I thought I had finally fixed it, but I still don't think it's fixed. Have followed all steps mostly in safemode and here are the logs.

Thanks for your help.
karendanette

TimW · Apr 28, 2009

Your logs are clean.....The file SWR_wizard.exe is completely genuine files from HP which gets installed on your computer by default. SWR_wizard.exe is the built in Software Recovery Wizard in the HP recovery console.

The only problem I see is this:

Total Physical Memory 256.00 MB
Available Physical Memory 55.31 MB
Click to expand...

You are in dire need of more RAM.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

karendanette · Apr 28, 2009

Thanks for your time in reviewing my logs. I'm glad to see that following the cleaning procedures posted here took care of such a huge job.

I knew she needed more RAM, but I didn't notice that there were only 55 MB of RAM available. I returned her computer to her yesterday, but will go back through the logs and get the specs and get her more RAM.

Thanks again for your time; you guys are amazing!:wave

TimW · Apr 28, 2009

You are most welcome.

Log in or Sign up

Possible swr_wizard.exe infection

karendanette Private E-2

Attached Files:

MGlogs.zip

SASlog.txt

mbam-log-2009-04-25 (12-19-24).txt

combofixlog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

karendanette Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member