I have an issue with a laptop of mine and I've tried some troubleshooting steps that have usually worked in the past, but this is proving a bit challenging. Things started when I noticed a fake anti-spyware program called System Restore which I promptly removed. While I was working to remove all traces another fake anti-spyware program called System Security 2012 popped up.
At this point I thought there was something in the MBR so I've focused my efforts there but have so far been unlucky. I can't seem to run TDSS Killer even if I rename it. MalWare Bytes has removed items but isn't reporting anything right now. I am not confident to bring this laptop online as it seems fine when it's not connected to the internet but seems to display infection symptoms when connected.
DDS doesn't want to end so I can't post a log. I get the following error wen I try to run GMER.
"LoadDriver("C:\DOCUME~1\<user>\LOCALS~1\temp\fgloapod.sys") error 0xC000010E: Cannot create a stable subkey under a volatile parent key."
As such I can't provide this log either.
If I boot into SafeMode I sometimes get a blue screen and sometimes it works just fine. Same for a normal boot. It seems to happen more when I have my USB stick plugged in when I reboot so I've been removing that each time.
If I try to boot to recovery mode it never seems to load. If I boot to a windows XP CD I can get to the repair option there but I haven't run anything yet.
I really don't want to format at this point so I'm looking for options.
Edit: I was able to get MBRCheck to run.
MBRCheck, version 1.2.3
© 2010, AD
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000000ec
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02738a00 (NTFS)
Size Device Name MBR Status
149 GB \\.\PhysicalDrive0 MBR Code Faked!
Found non-standard or infected MBR.
Edited by CHUPON, 10 November 2011 - 10:36 AM.