Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

combofix question / win 7 x64 with alureon rootkit


  • Please log in to reply
3 replies to this topic

#1 hihat

hihat

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:17 AM

Posted 13 March 2011 - 08:10 PM

Hi there,

by downloading an executable that looked like a freeware program from the internet my trouble started. It wanted to open the command prompt repeatedly and didn't let me do anything else than clicking on no buttons. All of a sudden a kind of fake security application was installed. When I tried to clean it by running drweb cureit, a rootkit was detected and just when drweb cureit tried to delete it, the machine stopped working. It doesn't even restart in safe mode but stop all the time with a bluescreen during the boot process. I spent my sunday trying to fix it but no success so far. I was replacing the master boot record with ultimatebootcd4win, but didn't help, I was running drweb livecd which took more than 20 hours when it stopped with a segmentation fault. It discovered few things but not the rootkit anymore. Hitman Pro gave a hint to Alureon/TDSS but didn't solve the problem. I also tried the other av software coming with ultimatebootcd for windows. I was discovering the article on bleepingcomputer.com about combofix and wanted to give it a try - ok, it's risky, but what can I loose - I mean otherwise if I don't get my machine clean I have to spend a day reinstalling the system, all software and so on.
So in the article and on the download site it was saying it's running with windows 7 64bit. However when I tried to run it from ultimatebootcd 4 win it says only 32bit, and that only windows xp and 2000 are supported (the basis for ubcd4win is win xp 32bit, but the system affected was a windows 7 64bit). So how to get combofix work? or what else could I do?

Thanks for ideas, help, guidance, advice.
And have a good (better) start into the new week.

David

BC AdBot (Login to Remove)

 


#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:17 PM

Posted 13 March 2011 - 08:14 PM

Skip ComboFix for now and try this:

http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 hihat

hihat
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:17 AM

Posted 14 March 2011 - 06:17 AM

thanks for the idea. I put that kaspersky tdss killer on my usb stick that I equipped with ultimatebootcd4win. I can start the file in ubcd4win and it scans 3 objects in a few seconds, afterwards saying no threats found. I guess it just checks the system that is currently running (the ubcd4win from the stick) but not the system that was infected (which is by the way not display as c:\ but as i:\ in the ubcd4win-filesys). As I cannot boot into my windows anymore (interrupts with a bluescreen, probably due to the infected harddisc driver) I don't see how I can run the tdsskiller. I think the MBR is already clean as I replaced it with mbrfix. It's only the manipulated drivers that hinder the system to start and make me headache.

Any further idea / help is deeply appreciated.

#4 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:17 PM

Posted 14 March 2011 - 04:08 PM

Okay I didn't realise that your computer won't boot. I should read a little more carefully. You can try a startup repair.

http://pcsupport.about.com/od/toolsofthetrade/ss/windows-7-startup-repair.htm
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users