I am running Windows XP SP3.
The problem first manifested itself shortly after browsing the megaupload.com website. There was a popup in the background I did not notice. Twenty minutes later, Avira Antivir guard detected an infection and reported the following:
Is the TR/Crypt.ZPACK.Gen Trojan C:\documents and settings\HP_administrator\local settings\temp\srcwenmoax.tmp
Is the TR/Crypt.ZPACK.Gen Trojan C:\documents and settings\HP_administrator\local settings\temp\rwcoeansmx.tmp
As I prepared to have Avira updated to perform a more complete scan of my system, I noticed that something started to take up all my system resources. Since things were running slowly, I opted to restart my computer. As expected, it didn't shut down very quickly. A few strange close program popups appeared before Windows shut down. I recall one program being titled something like hiddenfax... sorry, I don't remember the others; probably should have paid closer attention to them.
Anyways, my computer appeared to be restarting. Then when it hit the windows loading screen, I encountered the BSOD, a screen very similar to the one on this page: http://www.symantec.com/connect/blogs/tidserv-and-ms10-015 . There was an error with the atapi.sys file. I tried restarting using the last known good configuration and safe mode, and still the same BSOD. I finally found some instructions on this page http://www.myfixes.com/articles/system that allowed me to perform a system restore using the Windows recovery console. I was able to boot into Windows. Naturally, I wasn't confident that the problem was resolved, so I ran two programs which have helped me before.
Malwarebytes reported two instances of Rootkit.tdss and one other problem, which I asked the program to correct. They were:
C:\documents and settings\HP_administrator\local settings\temp\33.tmp
C:\documents and settings\HP_administrator\local settings\temp\34.tmp
registry data item:
Hijackthis output a log with some suspicious entries that weren't found in a clean log generated at an earlier time.
I don't know whether or not my computer is still infected. Can someone please advise on next steps to take?
Thank you! Your help is much appreciated!
Edited by csbeginner, 04 June 2011 - 12:48 AM.