Virus hidding as driver

Welcome to Major Geeks!

You need to attach logs from the below scans that were requested in the READ & RUN ME.

• SUPERAntiSpyware
• ComboFix
• RootRepeal
• MGtools

 

You have a couple infected partitions added to your hard disk as noted in the below in bold red:

Code:

Partition Disk #0, Partition #0 
Partition Size 11.76 GB (12,626,256,384 bytes) 
Partition Starting Offset 32,256 bytes 
Partition Disk #0, Partition #1 
Partition Size 221.12 GB (237,422,223,360 bytes) 
Partition Starting Offset 12,626,288,640 bytes 
[B][COLOR=red]Partition Disk #0, Partition #2 [/COLOR][/B]
[B][COLOR=red]Partition Size 10.33 MB (10,829,824 bytes) [/COLOR][/B]
[B][COLOR=red]Partition Starting Offset 250,048,512,000 bytes [/COLOR][/B]
[B][COLOR=red]Partition Disk #0, Partition #3 [/COLOR][/B]
[B][COLOR=red]Partition Size 8.00 KB (8,192 bytes) [/COLOR][/B]
[B][COLOR=red]Partition Starting Offset 250,059,341,824 bytes[/COLOR][/B] 

Do you have your Windows XP boot CD?


You also need to rerun TDSSKiller and have it fix the below items if still detected:

Code:

15:51:13.0312 1924 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
15:51:13.0312 1924 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 

Are the below items you knowingly installed?

 

Make the below CD and see if you can successfully boot to the Recovery Console command prompt. Let me know your results. Once you can do this, we can continue with the next steps.

Using ARCDC to get the Recovery Console Command Prompt

 

OK! Just get back to me when you can.

 

Yes 3 would be the correct choice for you.

We are going to begin by just deleting one of the suspected problem partitions.

Please download: gparted-live-0.12.0-5.iso (124 MB)
Create a bootable CD for GParted. You can use ImgBurn to accomplish this.
If you need help on how to use ImgBurn, please view this guide by dr.m -- Using ImageBurn to Burn an ISO image

Now boot off of the newly created GParted CD.
http://img717.imageshack.us/img717/6546/gpartedsplash01107.th.png
You should be here...
Press ENTER
http://img819.imageshack.us/img819/7286/gpartedkeymaps.th.png
By default, do not touch keymap is highlighted. Leave this setting alone and just press ENTER.
http://img404.imageshack.us/img404/9840/gpartedlanguage.th.png
Choose your language and press ENTER. English is default [33]
http://img140.imageshack.us/img140/7958/gpartedgui.th.png
Once again, at this prompt, press ENTER
You will now be taken to the main GUI screen below
http://img32.imageshack.us/img32/1122/gpartedo.th.png
According to your logs, the partition that you want to delete is 8 KB
Click the trash can icon to delete and then click Apply.
You should now be here confirming your actions:
http://img233.imageshack.us/img233/1533/gpartedsteps.th.png
Now you should be here:
http://img696.imageshack.us/img696/8471/gpartedsuccessclose.th.png
Is boot next to your OS drive? According to your logs, your OS drive is the 221.12 GB sized partition.
http://img194.imageshack.us/img194/7753/gpartedboot.th.png
If boot is not next to your OS drive under Flags, right-mouse click the OS drive while in Gparted and select Manage Flags

In the menu that pops up, place a checkmark in boot like the picture below:
http://img196.imageshack.us/img196/3483/gpartedmanageflagsboot.th.png
Now press the Close button to save these changes.
Now double-click the http://img822.imageshack.us/img822/641/gpartedexit.png button.
You should receive a small pop up like this:
http://img88.imageshack.us/img88/8986/gpartedexitreboot.png
Choose reboot and then press OK.


Now reboot from the Windows XP Recovery Console CD and execute the following commands pressing ENTER after each:

• fixmbr
• fixboot
• exit

Once back in Windows...
http://img707.imageshack.us/img707/6703/generalxpicon.gif Re-run another scan with MBRCheckand attach its latest log. (How to attach)

 

You mean 10.33 MB not GB.

8KB, This is a million times smaller.

Before doing anything with the 10.33 MB partition, I want to know how things are running right now.

 

What toolbar are you referring to?


Now let's rerun the procedure with G-Parted, but this time delete the 10.33 MB partition. And also this time after reboot, do not bother running MBRcheck. Instead do the below.

Download the current version of TDSSkiller and rerun it. Quarantine the below if they still appear.

Code:

15:51:13.0312 1924 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
15:51:13.0312 1924 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

Now see if you can run ComboFix as requested in the READ & RUN ME.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• the c:\combfix.txt log if it ran
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Combofix just deleted it. Are you sure you still have this problem?

Uninstall your paid copy of Malwarebytes, then reboot. After reboot, reinstall and reenter your license code. Make sure you update it to current database and run a full scan.

What is the below stuff you just put on your PC? You should not be doing anything except what we request.

Code:

2012-03-27 19:53 . 2007-11-21 08:38 161344 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\UNWISE.EXE
2012-03-27 19:53 . 2012-02-13 16:30 381 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\unpackJars.bat
2012-03-27 19:53 . 2012-03-27 19:53 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\jre
2012-03-27 19:53 . 2012-03-27 19:53 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\resources
2012-03-27 19:53 . 2012-03-27 19:53 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\HtmlHelp
2012-03-27 19:53 . 2012-03-27 19:53 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\doe2
2012-03-27 19:53 . 2012-02-13 16:30 74 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Start_REScheck_CL.bat
2012-03-27 19:53 . 2012-02-13 16:30 128 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Start_REScheck_CL_Log_Debug.bat
2012-03-27 19:53 . 2012-02-13 16:30 111 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Start_REScheck_CL_Log.bat
2012-03-27 19:53 . 2010-04-05 15:38 1642591 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\areaCalc.exe
2012-03-27 19:27 . 2012-03-27 19:27 -------- d-----w- c:\program files\Check

Now download The Avenger by Swandog46, and save it to your Desktop.
See the download links under this icon http://www.majorgeeks.com/images/dll.gif

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

After reboot look for all of the above files we had Avenger attempt to delete. If you still see them, delete them yourself.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7 make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You need to follow the instructions given to create a new log first.

 

Then just right click on it and select Delete.

Also you can look for the file related to the icon in the below folder and delete it this way too.

C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch


Your logs are clean.

 

A "fake" Adobe what popped up? And how do you know it is fake?

And what happens when you update it?

 

Show me a snapshot if you can.



Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Okay then it may have been valid.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!