Still getting search redirects, some missing files after Windows 7 fix virus

Still getting search redirects, some missing files after Windows 7 fix virus Want my laptop healthy again. :(

#46 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,515
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 04 August 2011 - 09:52 PM

when you are able click on the fixMBR button

gringo

This post has been edited by gringo_pr: 04 August 2011 - 09:53 PM

I will be online from 5-31 to 6-4 in a very limited amount

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic

Please Only Copy And Paste Reports Into Topic - Do Not Attach

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->

<-- Don't worry every little bit helps.

#47 wizzdb21

Member

Group: Members
Posts: 37
Joined: 11-July 11

Posted 04 August 2011 - 10:20 PM

So I actually hit fix instead...it went to the blue screen again but at least no screeching noise this time. Windows prevented my laptop from having an "unexpected shutdown" so I didn't lose any files, etc. Said it "recovered" from one.

Then it proceeded to ask me how I wanted to reboot, selected normal mode, and rebooted as normal. It seems to me that this rootkit won't allow any programs to get rid of it. Like it won't allow Windows to shutdown normally because doing so would threaten its hold on my laptop.

I don't know what else to do. I want my laptop back.

Anything else we can do??

#48 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,515
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 04 August 2011 - 10:27 PM

System Recovery Environment

To access the System Recovery Environment in Windows 7, simply boot your PC,

just before the system loads the Windows operating system, hit the [F8] Function 8 key on your keyboard which will launch the Advanced Boot Options menu.
There you will see a new option 'Repair Your Computer', select this option and hit 'Enter' on your keyboard.
Now, from the System Recovery Options dialog, select the "Operating System" you want to repair, then click Next:
From the "Choose a Recovery Tool" dialog menu, select "Command Prompt":
Type the following into the "Command Prompt Window": and press enter

If you have problems booting the computer after you have run that command boot back into the System Recovery Environment and Type the following into the "Command Prompt Window": and press enter

bootrec.exe /fixboot

<-- Don't worry every little bit helps.

#49 wizzdb21

Member

Group: Members
Posts: 37
Joined: 11-July 11

Posted 05 August 2011 - 07:40 AM

So I can only hit the fixMBR during the scan, afterward it is shadowed and won't let me. Why is it different than the fix button? What is the MBR? I hit it during the scan and it warned me I might lose all my partitions. I cancelled it because I wasn't sure what that meant.

To clarify, everytime I turn off my laptop, it asks me to force shut it down because there are programs running in the background. It says doing so I might lose work if not saved, do I want to proceed, etc. I usually have no choice because it proceeds to shut it off anyway.

aswMBR is unable to fix and remove those rootkits for whatever reason. Do you think by using the System Recovery Environment will aid that program in getting rid of those rootkits? Let me know, I will run it if you say so.

#50 wizzdb21

Member

Group: Members
Posts: 37
Joined: 11-July 11

Posted 05 August 2011 - 09:12 AM

So I tried the System Recovery Environment and my computer wouldn't boot afterward. I did bootrec.exe /fixboot and it still won't boot. Startup repair automatically started and is attempting repairs. I tried to cancel it but it said this action cannot be cancelled. What is the next step?

#51 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,515
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 05 August 2011 - 10:56 AM

Try this please. You will need a USB drive.

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer

Insert your USB drive
Press Start > My Computer > right click your USB drive > choose Format > Quick format
Double click the unetbootin-xpud-windows-387.exe that you just downloaded
Press Run then OK
Select the DiskImage option then click the browse button located on the right side of the textbox field.
Browse to and select the xpud-0.9.2.iso file you downloaded
Verify the correct drive letter is selected for your USB device then click OK
It will install a little bootable OS on your USB device
Once the files have been written to the device you will be prompted to reboot ~ do not reboot and instead just Exit the UNetbootin interface
After it has completed do not choose to reboot the clean computer simply close the installer
Next download http://noahdfear.net/downloads/driver.sh to your USB
Remove the USB and insert it in the sick computer
Boot the Sick computer
Press F12 and choose to boot from the USB
Follow the prompts
A Welcome to xPUD screen will appear
Press File
Expand mnt
sda1,2...usually corresponds to your HDD
sdb1 is likely your USB
Click on the folder that represents your USB drive (sdb1 ?)
Confirm that you see driver.sh that you downloaded there
Press Tool at the top
Choose Open Terminal
Type bash driver.sh
Press Enter
After it has finished a report will be located on your USB drive named report.txt
Remove the USB drive and insert back in your working computer and navigate to report.txt

Please note - all text entries are case sensitive

Copy and paste the report.txt for my review

<-- Don't worry every little bit helps.

#52 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,515
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 08 August 2011 - 12:15 AM

Hello

48 Hour bump

It has been more than 48 hours since my last post.

do you still need help with this?
do you need more time?
are you having problems following my instructions?
if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

<-- Don't worry every little bit helps.

#53 gringo_pr

Bleepin Gringo

Group: Malware Response Team
Posts: 85,515
Joined: 03-July 08
Gender:Male
Location:Puerto rico

Posted 11 August 2011 - 12:06 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.