I've currently got the TDSS virus (Windows 7 ultimate, x64) and cannot boot into Windows, so all the available tools are unavailable to me until I can at least get this figured out. I know it's TDSS because I got it 3 months ago, but was able to fix it (and now I know I definitely should have used more antivirus). The symptoms are crashing on reboot due to corrupt system file (rdyboost.sys or something like that, but I know that's not the problem), and my hard drives randomly getting repartitioned.
The main problem is that I forgot what I need to do to the boot record to just get the machine booting up so I can go get the Kaspersky tools and recovery disc for future incidents. I do have a Windows 7 CD, and this is what I did so far from the recovery console:
-delete old bcd file and build a new one using bootrec /rebuildbcd
-rebooting failed, so I repeated that, booted into console again, and ran sfc /scannow, which said there was a system repair pending and could do nothing
-rebooting failed again, so I again repeated those steps and ran sfc again with the offbootdir flag. This time it said windows resource protection found corrupt files but was unable to repair them
This is where I'm stuck. I can't find any other info that has help at the recovery console level, and I'd really like to avoid a reformat, especially knowing that TDSS survives reformats because it sits in the master boot record.
Thanks in advance.
edit: ok, I found out that the partitions on my boot drive had been set to inactive, so I set the main one to active using disk part. After doing the and a few startup repairs, I got my drive letters back, but bootrec /scanos still shows 0 installations even after I rebuild the mbr. Startup repair ran 3 times and ultimately said that it was simply unable to solve the problem. SFC is still failing with the same unable to replace corrupt files error. Hmm... I tried using win7's custom install to check partitions, and this time I don't seem to have that mysterious 7mb partition I had last time I had TDSS. I'm not sure why rebuilding the mbr is failing...
edit 2: I really wish I remembered how I got past this before. The rdyboost.sys file is completely stopping me from booting, regardless of mbr. Initially the error was 0xc0000221, and then I renamed the file and now I get 0xc000000f, but still on rdyboost.
edit 3: Damn. I randomly decided to try System Restore, despite the fact that I had not rebooted in 10 days and also that I didn't even have a point. I had been messing with Windows Update which is constantly failing on some .net framework updates, so I had uninstalled 4.0 in an attempt to reinstall. Windows was gracious enough to create a restore point for me right before the first uninstall, and loading that worked. Whew. Running TDSSkiller after that found 1 infection, which I deleted. Time to go nuts on antivirus scanning.
Edited by Orange Blossom, 04 July 2012 - 08:56 AM.
Moved to log forum. ~ OB