On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.
If it is shutdown automatically, then it is most likely the infection detecting that aswMBR is running and terminating it. In this situation you should rename executable to iexplore.exe before you attempt to run it again.
I really appreciate your persistence!
I downloaded the aswMBR. It would not run on my desk top, even after I renamed it. I opened a new folder on the desk top and was able to run the program from this folder. I don't know how that affects the results, but the log is attached.
I did try to run the tdsskiiller the same way - wishful thinking! It didn't work.
My PC did shut down after running the aswMBR, but not before the log was produced and saved. I hope there's finally something to look at!
First, since you were unable to boot into Recovery Mode on the system when we tried to run one of the previous tools, can I ask if you created a System Repair Disc when you got your system? If you did not, we are likely going to need to try and create one (but we can do that after I see the results of the next logs).
In the event we are not able to create such a disc off your system, do you have access to a known clean Windows 7 64bit computer that you could use to create one?
===========================
Please work through the steps below: (If you have any trouble with these steps let me know.)
xPUD
We will need a USB stick and access to an uninfected machine.
We need to prepare the USB stick. It is not absolutely essential that it is formatted, but it may help if it is:
Insert your USB drive ino the uninfected machine.
Click on Start > My Computer > right click your USB drive > choose Format > Quick format.
Next
Please use Firefox to download each required tool (Internet Explorer can sometimes encounter problems).
I did not create a repair disk, but I do have access to another system to create one.
I will not have access to a good pc until tomorrow morning, to complete the steps you outlined, but I will do them then and post the results.
Thanks for all your help!
Great! I'll take a look at them once you've had a chance to do the steps. We may need to create that repair disc before we move on (depending on the log results) so it's good to know that you do have another computer to work from if we need it.
The first screen for the xPUD was a screen to choose language. After English was selected, a black screen loaded and scrolled a lot of text - the end result was that it could not load. I never had the option to select file and complete the process.
I've created the repair disk from another PC.
OK then….let's take a step back and punt. While it may or may not show me what I need, the aswMBR log shows that it created a file called C:\Users\ANON3\Desktop\New folder\MBR.dat can you please see if you can attach that file to your next reply? It may or may not show me what I need. XPUD would have been the ideal answer but if you are having trouble running it, let's see if we can get the answer an easier way first before we struggle forward
I'm glad you have the repair disc on hand! I'm relatively sure we are going to need that in any repair steps we need to try.
The MBR file was associated with clear.fi and opened that when I clicked it. When I try to attach here, it gives an error that I'm not permitted to attach the file type.
Well, the good news is that I didn't see what I expected to find in that file! The bad news is that we still have one tough little bugger on our hands. I have some suggestions from my peers and let's try the easier of the two first. Since I see you already have Malwarebytes on your machine, let's try this:
We're going to try a different method to get TDSSKiller running. This requires that Malwarebytes is still installed, if you have uninstalled it please download it again.
Step 2. Place TDSSKiller.exe in Malwarebytes Chameleon folder.
C:\Program Files\Malwarebytes' Anti-Malware\Chameleon
Step 3. Install the Chameleon driver by doing the following:
Press the Windows key + R and in the Run box, copy and paste the following command then press Enter.
A black DOS prompt will appear with a prompt to press any key to continue, please do.
Step 4. Execute TDSSKiller.exe by doubleclicking on it
Press Start Scan
If Malicious objects are found, ensure Cure is selected (it should be by default)
Click Continue then click Reboot now
Once complete, a log will be produced at the root drive which is typically C:\
For example, C:\TDSSKiller.version_date_time_log.txt
I am so excited! It worked!
I had to tweak your directions a little though and I'll explain what I did here, incase it affects the outcome. When I moved tdsskiller to the chameleon folder, it still would not run. I attempted to rename it- but was prompted with an error that I cannot mod or delete the fiole. So I d/l the tdsskiller again and renamed it and then moved it to the chameleon folder. It create two logs - one before a reboot and one after a reboot. I'm going to post both because I don't know which you need.
Let's see if we can get the detection with this tool: