Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

System volume information infection


  • Please log in to reply
7 replies to this topic

#1 cookieboymr

cookieboymr

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:42 PM

Posted 05 July 2010 - 11:36 AM

Yes, thats it :thumbsup:

Please click Start > Run, type notepad in the runbox and press enter.

Copy/paste the following text into Notepad and save it as fixme.bat in the same location as bootkit remover.

@echo off
remover.exe fix \\.\PhysicalDrive0
exit
Exit Notepad and doubleclick on fixme.bat to run it.
After a reboot, rerun remover.exe and let me know what is now listed under MBR status.



"After a reboot, rerun remover.exe and let me know what is now listed under MBR status."

It now says:

OK <DOS/Win32 Boot Code Found>


Sounds like good news. ?
One strange event, however, immediately following the above.
Icon in system tray - "Windows has found new hardware" I think it said. Then a notice that the software needs a restart for the new hardware, or something similar.
I haven't rebooted though.
??

(Haven't installed anything new on the computer since I discovered the Trojans several days ago).


hi there i am having the same problem as blixx i followed the instructions like you said to do however, when it gets to these steps first making the fixme.bat file and do a restart i then begin to rerun remover.exe and under the MBR status there is no change mine is still Unknown boot code i re-read all the previous steps and the only difference i could notice was the fact that blixx has xp and i'm using vista ? maybe thats why mines is still the same ?

hope u can help thanks

BC AdBot (Login to Remove)

 


#2 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,115 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:42 PM

Posted 05 July 2010 - 11:58 AM

Never follow instructions that are specific for another user! You can do quite some harm that way!

Do you have your Vista DVD at hand?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#3 cookieboymr

cookieboymr
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:42 PM

Posted 05 July 2010 - 12:24 PM

no mate i dont even know if i got one with this laptop and if i did i think i have lost it

#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,115 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:42 PM

Posted 05 July 2010 - 12:58 PM

Please run remover.exe and let me know what the name is of your drive.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#5 cookieboymr

cookieboymr
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:42 PM

Posted 05 July 2010 - 01:51 PM

it says \\.\PhysicalDrive0

#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,115 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:42 PM

Posted 06 July 2010 - 01:11 AM

Do you have a Dell computer, multiple partitions or more than on OS installed?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 cookieboymr

cookieboymr
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:42 PM

Posted 09 July 2010 - 05:58 PM

sorry been a few days since i have got back to u about this problem i identifed my virus/trojans as smss.exe and services.exe but i couldnt get rid of them with any av software so i had kind of decided i was gonna do the thing on vista where u can restore your system to the factory default settings because i had wanted to do this for ages to kinda start a fresh so i backed up my files and folders onto my external hd and done it. went throught qith no problems i thought great! all i need to do now is use the windows update feature to get me upto speed but i kept getting so far with updates and the i would get the blue screen of death most the time with the IRQL_NOT_LESS_OR_EQUAL message but i got other ones too and i was unable to boot into windows was like on a loop but what i could do was choose the system restore or the return to factory settings thing again so i restored it again to a fresh n tried the updates again this time i got windows vista sp1 installed fine but i still got a few times of the blue screen situation whilst installing it.

so it was fine after i had installed sp1 so i thought it was sorted so i then proceeded to update to sp2 and i thought that was installed fine too but it got to like stage 3 of 3 configuring updates and i got the blue screen it restarted and went back to the same stage 3 of 3 then it worked this time no blue screen i got to logon i tried a restart to see if it would restart without the blue screen thing and it did so i logged on and went to install the final lot of updates that where in the windows update menu listed as recommended updates (i think thats what they where listed as) there where three listed there i can remember the was one for realtek one for ralink wireless and another which i cant remember but i clicked to install them too and it gave me the updates installed once they had and windows has to restart to finalize the updates i did so.. so when it restarted it got so far and guess what i got the blue screen thing again!! so i had to restart again and now it wont boot at all when i turn it on dont get anything on the screen or nothing so i cant even get in to start in safe mode or the repair option to do a system restore or anything.

its an Advent 9117 laptop that i have i found a topic by google where some ppl have a similar problem here..

http://www.adventsupport.com/viewtopic.php?f=1&t=6560

hope u or someone can help i recon this will maybe have to be moved to a new topic now aswell as its maybe not about a virus anymore . sorry for the long post too.thanks:)

#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,115 posts
  • ONLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:05:42 PM

Posted 10 July 2010 - 07:07 AM

To me this sounds like dying hardware. I think best would be to start a topic here, with a reference to this topic.

Please post back here once you have posted the new topic.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users