BleepingComputer.com: black hole exploit on my winxp machine

Hello.

My Win XP pro sp2 machine is apparently infected with something. Yesterday, whenever I would go to google and click on any link from the page of results, I was redirected all over the place. I had avg free on the machine. It had warned me about something, when I went to check (can't remember what it was, sorry), it said it was related to the black hole exploit 1384. I uninstalled and reinstalled avg, did a scan, it came up with nothing. rebooted my computer, and it would not boot back up.

Anyway, I read through the preparation guide, which really seemed to not be relevant, as I cannot boot my machine to install the programs needed. I wanted to confirm what my first step should be. Should I start with the recovery console tutorial?

Thanks in advance for any knowledge you can impart.

This post has been edited by hamluis: 04 April 2011 - 10:17 AM
Reason for edit: Moved from XP to Am I Infected.

I will ask for assistance from the more knowledgeable...be patient .

Louis

Placed on unbootable thread.

This post has been edited by hamluis: 04 April 2011 - 10:22 AM

Hello,
Try this please. You will need a USB drive.

Download GETxPUD.exe to the desktop of your clean computer

• Run GETxPUD.exe
  
• A new folder will appear on the desktop.
  
• Open the GETxPUD folder and click on the get&burn.bat
  
• The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
  
• Click on Start and follow the prompts to burn the image to a CD.
  
• Remove the USB & CD and insert it in the sick computer
  
• Boot the Sick computer with the CD you just burned
  
• The computer must be set to boot from the CD
  
• Gently tap F12 and choose to boot from the CD
  
• Follow the prompts
  
• A Welcome to xPUD screen will appear
  
• Press File
  
• Expand mnt
  
• sda1,2...usually corresponds to your HDD
  
• sdb1 is likely your USB
  
• Click on the folder that represents your USB drive (sdb1 ?)
  
• Press Tool at the top
  
• Choose Open Terminal
  
• Type the following and press enter:
  
  dd if=/dev/sda of=mbr.bin bs=512 count=1
  
  
  
• Press Enter
  
• After it has finished a file will be located on your USB drive named mbr.bin
  
• Remove the USB drive and insert it back in your working computer and navigate to mbr.bin, zip it up and upload it here: http://www.bleepingcomputer.com/submit-malware.php?channel=105

This will allow me to have a look at the MasterBootRecord of your drive and see if it is infected.