Malware Discussions

[rod-puckey]

ASWMBR log attached.

[malwarekiller]

Thats the Malwarebytes Log please run ASWMBR and attach the log on next reply.

[malwarekiller]

The MBR is faked and this is obviously the tougher variant.  So we will need to fix it whilst it is inactive  

Create a Windows 7/Vista System Repair Disc 
 
Note: the below can only be done if your machine has a a type of CD/R or DVD/R optical drive installed. Also depending on the exact type of OEM your machine has you may be unable to actually create a SRD. 
 

• Click on Start(Windows 7 Orb) >> Run...(or the Windows key and R together) to bring up the Run box, then copy/paste the following command into the box and click on OK: 

 recdisc.exe

• Allow the UAC(User Account Control) prompt via selecting Yes. 
• You should now see a menu like the below:-

 
 

• Put a blank rewritable  CD/DVD in your optical(CD/DVD) drive and then click on Create disc. 
• Note: If a AutoPlay window pops up, just close it. 
• When the SRD has been created you will see the below:-

 
 

• Now click on Close >> OK. Leave the disc in the drive as we will be using it shortly. 
• You now have a Windows 7/Vista System Repair Disc. 

.
Reboot the computer and start from the CD



When you reboot you will  see this although yours will say windows 7/vista. Click repair my computer 
 
 
Select your operating system 
 
 
Select Command prompt 
 
 
At the command prompt type the following  
 
Bootrec.exe /FixMbr  [notice space between e and /]
  

• Once finished type Exit

[rod-puckey]

Hi,

Sorry to have taken a few days to get back on this, work has been in the way.

I have tried to run Recdisc.exe as you suggested, without any success.

I have tried on 2 different laptops and 1 desktop, nothing doing.  Tried different discs, prepared and unprepared, no go.

All machines were running Vista 32.

Rod

[malwarekiller]

Lets try a different option to confirm my guess...Do u have a SD memory stick?

Download Bootkit Remover to your Desktop.

• Unzip downloaded file to your Desktop.
• Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).
• It will show a Black screen with some data on it.
• Right click on the screen and click Select All.
• Press CTRL+C
• Open a Notepad and press CTRL+V
• Post the output back here.

[rod-puckey]

Hi,

Screen shot of the output attached.

Rod

[malwarekiller]

i think thats your SD Stick....

Can take off the SD memory stick and run it again and post the output.

[rod-puckey]

Attaqched.

Rod

[malwarekiller]

Please click Start > Run, type notepad in the runbox and press enter.

Copy/paste the following text into Notepad and save it as fixme.bat in the same location as bootkit remover.

@echo off
remover.exe fix \\.\PhysicalDrive0
exit

Exit Notepad and doubleclick on fixme.bat to run it. 
After a reboot, rerun remover.exe and again paste the info in it here on next reply.