Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Please help me get rid of this Rootkit!


  • This topic is locked This topic is locked

#31
akwit

akwit

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
You are not going to believe this (or maybe you will)-
my computer is telling me that my external back-up drive needs to be formatted and when I try to format it says it cant be formatted.
The same thing happens to FOUR DIFFERENT drives. Cant be a coincidence, right?

Is this part of the Malware?? Thankfully I backed everything up about a day before this whole thing happened but i did not have a chance to backup my documents and settings.

Should I go ahead anyways?
  • 0

Advertisements


#32
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
If you did backup couple of days ago then please continue. You can also use blank DVD disk and try to burn your documents if you need them.

Backup is just something we all need to do it these situations. You can continue now.
  • 0

#33
akwit

akwit

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
It wont let me run the BDR tool!
I am now getting Trojans every couple of minutes!!!

Pls find the MBR attached.

Attached Files

  • Attached File  MBR.zip   568bytes   25 downloads

  • 0

#34
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Hi akwit,

I am now getting Trojans every couple of minutes!!!


That must be because we found it and tried to analyze it.

Step 1

Run MBRCheck.exe once again.

You will be presented with the following dialog:

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:



Enter Y and press Enter.

The following dialog will be presented:

Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice:



Enter 2 and press Enter

The following dialog will be presented:

Enter the physical disk number to fix (0-99, -1 to cancel):



Enter >>0<< and press Enter

The following dialog will be presented:

Available MBR codes:
[ 0] Default (Windows XP)
[ 1] Windows XP
[ 2] Windows Server 2003
[ 3] Windows Vista
[ 4] Windows 2008
[ 5] Windows 7
[-1] Cancel

Please select the MBR code to write to this drive:



Enter >>5<< and press Enter

The following dialog will be presented:

Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue:



Type YES and press Enter (Must type the full word, YES). You will be inform if successfully wrote a new MBR code!

And last the following dialog will be presented:

Done! Press ENTER to exit...



Press Enter. A report will be produced on the desktop. Post that report in your next reply.

Step 2

After you post report restart your system and hopefully it will boot normally. Download new version of Combofix and run it as you tried before. Post Combofix log after the scan

Step 3

Please don't forget to include these items in your reply:

  • MBRCheck log
  • Combofix log
It would be helpful if you could post each log in separate post
  • 0

#35
akwit

akwit

    Member

  • Topic Starter
  • Member
  • PipPip
  • 20 posts
Maliprog-

Thank you for the help but this whole thing was degrading so quickly, I chose to just buy a new harddrive and reinstall my OS.
  • 0

#36
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
It's your call. Thank you for letting me know.

If you like to continue with the fix please post logs otherway I'll close this topic.

Goodbye and stay safe :thumbsup:
  • 0

#37
maliprog

maliprog

    Trusted Helper

  • Malware Removal
  • 6,172 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP