BleepingComputer.com: Removing consrv.dll virus

My brother-in-law asked me to look at his computer because the McAfee firewall kept turning off. It's a Windows 7 system.

I scanned with McAfee, Spyware S&D and Malware Bytes, all fully updated, and they found nothing. I booted the Antivir rescue disk and it found three viruses. The first two were in C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The files were idko.exe and umaqe.exe and Antivir said they were both examples of TR/Obfuscate.QG.184. The third was C:\Windows\System32\consrv.dll and Antivir said it was the TR/ATRAPS.Gen2. It renamed all three files and I rebooted.

Windows wouldn't boot, even in safe mode. It would start and then reboot before it got very far. From my research, the problem was consrv.dll. There is apparently a registry entry which needs to be changed to point to winsrv.dll instead of consrv.dll to delete the virus cleanly.

I used BartPE to boot and rename the file back to consrv.dll. The system booted fine. I tried to make the registry change and it would immediately revert back. Since then I have also tried the Kapersky rescue disk, fully updated, and it doesn't even see the virus.

I have since deleted the two viruses in Startup with no harm. However if I do anything to consrv.dll, the system becomes unbootable. I have no idea what the next step would be, short of a complete reformat and reinstall.

To complicate matters, I have access to this computer only Mondays and Fridays during the time I'm taking care of their daughter, so it's hard to really focus on the problem.

I seen this infection three times on my client's computers. It's really tricky. In my experience, whenever I deleted the consrv.dll and rebooted, it would force Windows to run a start up repair. To save a lot of hassle, the easiest way to get rid of this infection is to run a system restore to before the computer was infected. The three times I had to remove this virus, I knew exactly when the client was infected. All I did was run a system restore before that date and the computer was clean. I ran Malwarebytes and other scans to make sure everything was gone.

It looks like ZeroAccess rootkit.

With the information you have provided I believe you will need help from the malware removal team.
Please make sure that you read the information about getting started first.
Then start a new thread HERE and include or required logs.
Including a link to this thread will be helpful.

Good luck and be patient. Help is on the way!

New thread at http://www.bleepingcomputer.com/forums/topic417190.html

Thanks for any help you can give. I'd rather not use system restore since I don't know how long he's been infected, so I'm hoping I can extricate the malware cleanly.

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the logs you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on, the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Now that your log is posted and you are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Removal Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.

Louis