I have been dealing with "m0le" over at the anti-malware forum at the following url:
We came to an impasse and m0le instructed me to post here, writing: "Please post in Bleeping Computer's XP forum for help. Link to this forum and explain that the boot sequence seems to be causing the problem."
My PC is infected with two strains of TDSS (TDL3-Alureon Variant Rootkit), one of which has overwritten the MBR.
m0le instructed me to burn a Windows XP Recovery Console Bootable ISO CD and then to use the Windows Recovery Console in order to execute the "fixmbr" command and try to undo the damage caused by the rootkit.
I had, on my initial post to the malware forum, disclosed the following information about my PC (which I will reproduce here):
"I should also mention that I am somewhat hamstrung on this PC because there is a separate error: The PC hangs when trying to boot in safe mode. This has been going on for some time. It used to hang at some file (I forget now which one) which I, through research, determined to be non-critical and so deleted. Now the PC hangs on safe mode boot at the file MUP.SYS. Apparently, the fix is to repair the XP OS. But, the Dell that I have had a defective CD-ROM drive. I recently (say 3 weeks ago) replaced the drive with a DVD-ROM, but I can't put my finger on my XP disks."
As I suspected, the underlying issue just mentioned became a problem in dealing with the malware issue.
Here, reproduced from the aforementioned thread in the malware forum, is my statement regarding the difficulties that I had booting the PC with the Recovery Console Bootable disk, the XP Pro disk (which I located subsequent to my initial post), and my inability to use the Recovery Console.
"Firstly, I did download the XP Recovery Console Bootable Disk ISO on a clean PC. I double clicked the ISO file and my burner program, Nero (apparently the program defaulted to open ISO files), seemed to make it easy to burn it to a CD - which I did.
"Secondly, I attempted - after verifying in the BIOS that my IDE-DVD-ROM drive was prior to the hard drive in the book sequence - to use the CD to boot the PC. And, after listening to the brief 3.5" floppy test, the DVD-ROM could be heard spinning; however, the boot sequence seemed to bypass the CD altogether, proceeding quickly to Windows XP normal load. (It seemed that an option for Recovery Console appeared practically for a mere INSTANT, and then vanished.)
"Thirdly, I put in additional effort to locate my actual full version copy of Windows XP Pro, which I was finally able to track down. And I then attempted to boot the PC from the XP Pro full version. The PC could again be heard trying the floppy drive, then the DVD-ROM drive, at which point the PC hung on a black screen. I left the PC sit for over an hour with no discernible change in this black-screen-hang until, able to bear it no longer, I availed myself of the power button. (I take it, however, that this episode demonstrates that the DVD-ROM drive was indeed prior to the hard drive in the boot sequence. I confess, though, that I cannot be SURE that my XP Pro disk is a bootable disk - but it seems that I have used it that way on an earlier occasion.)
"Fourthly, I allowed Windows to begin to boot normally - with nothing in the DVD-ROM drive - and, since I have a Dell PC, pressed F12 for "Boot Sequence" options. This function key provided various choices. One option was labeled "Utility Boot" (or something close to that). But, after selecting that option, the PC hung again. Another choice said (something like): "Boot from IDE device", but gave an error that repeated every time I pressed F2 to "retry device". (Bear in mind that the DVD-ROM drive functions in normal Windows mode usage.)
"Fifth, since ComboFix had previously installed the Recovery Console, I simply pressed "R" when the - very BRIEF (see above) - option for Recovery Console was displayed. This actually worked to get me to a screen that said (at the bottom): "Starting Windows Recovery Console" (or something close to that). And there was a process bar that progressed beautifully from left to right and then... promptly stopped. The PC hung up on the "Starting Windows Recovery Console" screen. And an hour of time again was insufficient to perceive any relevant change."
So...the point is that the PC that I have will boot into normal mode, but will not boot into safe mode, nor will it boot from the Recovery Console Bootable disk, nor it it boot from my copy of Windows XP Pro (which, if memory serves me, IS a full version, bootable disk).
Any help would be appreciated. Thank you for your time.
Sorry - the model would have been good information to provide.
I have a Dell Dimension 4500S.
Edited by hamluis, 19 September 2010 - 06:09 AM.
Removed malware log, not germane here ~ Hamluis.