I've tried it all. I ran virus scanners. I ran live CD virus scanners. I've used Hiren's boot CD and FalconFour's ultimate boot CD. I can detect viruses but for the life of me I cannot remove them all. I've tried ComboFix, it won't run after the blue screen appears after it's unpacked itself. Likewise with DDS. I've tried various other tools based on suspicions, IE win32k having been modified in the past couple months so I ran win32kdiag.exe. I've tried every rootkit scanner I can think of or find and they either don't run or don't find anything.
CMOS checksum errors when I use the Windows Recovery Boot CD to run various commands: chkdsk /r; fixboot; bootcfg /rebuild. Not sure if this means anything.
Please assist me in identifying root cause and removing this malware please. I booted into Windows to try some tools - ComboFix, dds, etc - after using various boot CDs to try and remove the malware and the machine is now infected with new, never before seen - by me - viruses. I was originally seeing only sality infections, now there are several others. I can rerun any test and provide any logs that would be needed to find out what's wrong with this system.
I think it may be worth noting that at first ComboFix wouldn't do anything once it unpacked itself and blink away at the blue screen, but now it gave me two errors after performing some tasks using Live CDs and Windows Recovery CD.
I didn't get a chance to write down the first one but it said something very close to:
ComboFix has detected interference. Close now and run a root kit scanner.
The second error is recurring:
C:\32788R~1 not in expected location. Inform sUBs now!!
I've tried re-downloading the file from bleepingcomputer.com. I've tried save link as to name the file something else in case something was looking for ComboFix.exe in the process list, but I can't get anything to work properly. At this point I'm hoping someone is going to get back to me and give me some steps to perform because as it is the system is just a PITA and isn't going anywhere in terms of resolving the issue.
Edited by WrinkledCheese, 15 March 2012 - 09:44 AM.