BleepingComputer.com: Fake System Restore - Attempts to Remove/Clean

Windows XP SP3
Avast Internet Security


So the hub's netbook landed the fun fun Fake System Restore. Irritated & annoyed, he started clicking things before I had a chance to see what was going on...I believe his temp folder contents were altered.

I have been trying for two nights now to make it through the Remove System Restore guidelines with mixed results.

Here are some issues I've faced:

• It took a lot of attempts to get rkill on the desktop & run before this crap took over each attempt
  
• Rkill knocked out 4 processes
  
• TDSS did not find anything
  
• Usage of the keyboard & touchpad has been lost -- fully mouse-dependent
  
• Unhide.exe has already been run successfully
  
• Was able to run SuperAntiSpyware last night -- 4 items removed
  
• At one point the infected netbook showed connection to our home wifi, but I cannot get MBAM to update definitions
  
• Tried updating MBAM via install exe last night, but got an "access denied" error & update rollback
  
• MBAM prompts that last update was 50 days ago; tell it to update & it immediately says I have the latest version
  
• Upon windows (XP) launch, Avast (Internet Security) prompts "will not be able to protect mail/news" & check that it's not blocked by firewall
  
• Attempts at correcting Avast "Fix Now" item fail (Real-Time Shields are currently off)
  
• I cannot get MBAM to complete any scan due to a very quick BSOD/auto-reboot
  
• Was able to run MBAM long enough last night for it to find 4 items. Aborted scan & let it clean those up
  
• Ran MBAM full scan earlier tonight, found 3 items, then BSOD/auto-reboot
  
• Netbook was just sitting here now, after startup, nothing running, showing avast message (above), then BSOD

I'm at a loss for the most part right now trying to figure out what direction to go in at this point. I am attempting another SAS scan right now as I type this (nothing found but cannot update definitions).

mK

This post has been edited by mommehK: 20 October 2011 - 10:37 PM

I was just able to complete a quick scan in MBAM -- 10 items found & removed. Reboot, same issues as before (no keyboard/touchpad, no updating definitions, no fixing Avast shields). Attempting a full scan with MBAM now to see if it'll complete before a BSOD.


Edit: BSOD. Still pops up too fast & leaves to reboot before I can see any details.

This post has been edited by mommehK: 20 October 2011 - 11:03 PM

With the information you have provided I believe you will need help from the malware removal team.
Please make sure that you read the information about getting started first.
Then start a new thread HERE and include or required logs.
Including a link to this thread will be helpful.

Good luck and be patient. Help is on the way!

Thank you Broni! Bedtime here, will post all tomorrow.

Sure thing

Well maybe not. BSOD keeps popping, and finally popped and stayed while trying to use DriveImage XML:

DRIVER_IRQL_NOT_LESS_OR_EQUAL


It's a good thing I have short pixie hair, otherwise I'd have it all pulled out by now.



Headed out later for an HDD converter so I can slave that drive to my laptop and pull everything off. I guess reformatting is in my very near future.

mK

Follow mt reply #3.