Root Repeal appears to have encountered a problem.
I am going to contact the developer of the tool with this mishap
You need to open rootrepeal again
go to the same hidden file tab
right click the same MBR rootkit file
Path: Volume F:\
Status: MBR Rootkit Detected!
this time choose option #1- restore.
Reboot your computer.
Next:
do this:
Download Dr.Web CureIt to the desktop:
Doubleclick the drweb-cureit icon to start the program.
press start
Allow the program to run the initial express scan
This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan. Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
Once the short scan has finished, check the Complete scan box on the left side, even if nothing was found on the initial scan.
Then click the small green arrow button on the right under the Dr.Web Antivirus picture to start the complete scan. (This scan will take several hours)
During this complete scan - if Dr.Web finds an infection a window will pop up requesting your attention. Select the Cure button.
Note:(If the file cannot be cured, Dr.Web will automatically delete the file)
Once the scan is complete, on the menu bar, click file and choose report list.
Save the report to your desktop. The report will be called DrWeb.csv
Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
Close Dr.Web Cureit.
Please post the Dr.Web.txt report in your next reply
Hi,
from the tool developer - please disregard the instructions for restore with root repeal.
Having the MBR rootkit on that external drive, will not harm your computer unless you try and boot from it - which I don't believe is your case.
Just carry on with the Dr.Web cureit.
Hi,
I received a request from the developer of RootRepeal.
He would like to see what occurred, in case there are some bugs in the program that require tweaking:
He saw that the external hard drive represented itself to windows as a local hard drive, this may have caused the issue
If you could use the 'Dump' feature to obtain a copy of that MBR so the developer can see it.
He feels it is also possible that the drive may be corrupted.
He would also like to know what the filesystem is on the drive? It's most likely FAT32, but would like to make sure…
So on the "MBR Rootkit Detected!", right-click on that, and three options are presented:
-Restore and reboot immediately
-Restore
-Dump
Please
use the "Dump" feature, which will prompt you to save a raw dump of that sector to a file, and then upload it here as an attachment
I will then send that to the developer.
Thanks
I downloaded and scanned with DrWeb's scanner
Towards the end of the scan which took about 2 hours my pc stopped responding to all command so I could not save
a copy of the scan. I had other software running at the same time, maybe this caused a conflict ?
5 items were deleted or moved and 3 had no action taken, this was all on c:\
As per your request, I reran RootRepeal, the file you want is attached.
can you go into the Dr.Web program and see if anything saved in the reports section (I doubt it but it's worth a look)
Thank you.
Please do the following:
Please download Malwarebytes' Anti-Malwarefrom Here or Here
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so.
NEXT
Please do an online scan with Kaspersky WebScanner
Click on Accept
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.
NEXT
Open HJT click on Do a system scan and save a logfile button
once the scan has completed a notepad should open - copy/paste that log here.
sorry to ask you to keep running scan after scan, but with a rootkit, I don't want to take a chance that we have missed anything.
So in addition to the two scans above - could you please run this following scan:
Please download the GMER Rootkit Scanner. Unzip it to your Desktop. Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run. **Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT"entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
Click NO
In the right panel, you will see a number of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button. Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.
Hi catbyte
I had to spend some time out of my office today, I just started running the scans but I won't be finished till later tonight.
I will post as soon as all scans are finished but that might be late tonight or tomorrow morning
Jack
Hi catbyte
I am now running the kaspersky scan
My anitivirus is AVG 8.0, I disabled the active shield thinking it would also disable the antivirus but I just noticed that the antivirus is still running, I googled it and cannot find a way to disable the a-v without uninstalling it which is something i would rather not do
Will this cause problem with Kaspersky and the other scans I will be running later ?
Jacques
the items that Dr.Web found are in old restore points which we will clean up now.
Please do the following:
Create a new, clean System Restore point which you can use in case of future system problems:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
Now remove old, infected System Restore points:
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Select the More Options tab, under System Restore press Clean up… and say Yes to the prompt
Press OK and Yes to confirm.
NEXT
Download ToolsCleaner2 to your desktop and run it ( by de A.Rothstein & Dj Quiou )
Click the Pt. Restauration button and press OK to the prompts.
Click the Corbeille button and press OK to the prompt.
Click the Fichiers temp button and press OK to the prompt.
Click the Recherche button and let it run ( it may look like it freezes but let it continue )
Once it is done click the Suppression button and let it remove anything it finds.
Close the program
Next
Below I have included a number of recommendations for how to protect your computer against malware infections.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
Make Internet Explorer more secure
Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
For Firefox, I highly recommend these add-ons to keep your PC even more secure.
NoScript - for blocking ads and other potential website attacks
McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
Please read the guide by Rorschach112on how to prevent malware and about safe computinghere
Thank you for your patience, and performing all of the procedures requested.
no probs
CB