Virus cleanup brainstorming

Question

I'm in the process of cleaning up a virus from a friend's computer and so far I've managed to have the windows runtime clean. However, after a reboot the malware reappears. Another symptom is that the infected computer can't boot in safe mode.

My suspicion so far was that it's a malware service or a driver that's causing this, the latter being the most favorable option esp. given the safe mode problem.

However, after repartitioning, reformatting and reinstalling windows, the virus-related processes are still there. Not initially, but shortly after the first boot.

Just to mention - it's a Win XP box, has 2 partitions and the reinstallation and formatting was done on the partition where the OS was installed. The other one has only data but as I haven't started anything from this partition, I can't think of some automatic system process that could have executed an already infected EXE file.

Can anyone propose ideas on how/where this thing is hooking up so that it reappears after reboot and reinstall? I've checked the standard registry entries (Run* for HKLM and HKCU), all suspicious services are disabled, nothing fancy in the INI files (through MSCONFIG), etc.

ANY ideas are welcome! This is the most irritating malware I've ever had to deal with... (I'll write some other time how I cleaned up the runtime :))

Answer 1

No matter what, if the virus exec ran on your computer, there´s little chance to make sure all traces can be completely removed.

The only way to make sure it is completely removed is:

• Identify the virus correctly
• If the virus is of any downloader type, forget it. You cant make 100% sure all traces, rootkits, scanners and whatnot are fully removed.
• If it is not a downloader, make sure it isnt a virus that lives in "desktop.ini" etc. Remove the disk, plug it into a different computer that has working antivirus. Run a scan.
• Remove the virus.

Of course you can take it as a sport to hunt the thing, and you will learn a lot about it. Most current viruses consist of several parts that hook up differently.

Use Process Explorer, Filemon, Regedit to hunt it down. It is fun for a few times.

Answer 2

Jeff Atwood had a pretty good post about the steps necessary to clean a computer of spyware. You might want to take a look at that and see if it helps you any.

Answer 3

I have had good experiences with the folks over at bleepingcomputer.com. Follow their instructions for posting the initial diagnosis (usually involves running HijackThis) and they'll work with you to create/get the fix you need.

Answer 4

Be sure system restore is turned off and make sure it stays off after a reboot (every reboot) until you are sure you are clean. System restore is a favorite "hiding place" for malware and some will even turn it on after you turn it off. Lots of other great suggestions from others here as well.

Answer 5

Well you can try using the online scanner of ESET or kaspersky and see if it detects any virus or malware. Another option is to download anti-malware trial version software and scan the system. If it detects the malware you may consider purchasing it. ESET online scanner can remove the malware/virus for free during the virus scan.

Answer 6

Backup the second partition onto an external HDD (don't forget to press SHIFT while connecting the drive to override autoplay).

run Windows Setup, nuke ALL partitions and create 2 new partitions and install Windows again.

grab A-squared command line scanner (portable and free for personal use), update it and scan the external drive (remember, SHIFT while connecting the drive and hold it until the device is installed). check the result and delete any infected files, ONLY then restore the files to the second partition.

Answer 7

If it's come back after a reinstall then it's almost certainly a MBR virus. You have two main ways to delete it. One is to zero the disk and do a fresh install. The other is to delete the MBR using a hex editor or something (do this from another machine), and then booting into a Windows disk and using the fixmbr command to repair it. GMER has a program to scan the MBR of the machine, it's on the mainpage called mbr.exe - you might also want to run their scanner.

It's also worth checking the your memory sticks are clean, and the other computers on the network aren't infecting your new one (which probably comes onto the network before being fully updated, so is vulnerable).

Answer 8

It sounds like a MBR virus or a rootkit. Check MBR and alternate data stream (of all drives plugged even USB stick, and don't use suspicious CD)

Tools I recommend:

• General Anti-virus (do a full deep scan, ideally from a bootcd (ubcd4win), with all options to speed the scan disabled):
  • Kaspersky Virus Removal Tool (included in ubcd4win)
  • Malwarebytes' Anti-Malware (included in ubcd4win)
  • Nod32 (instructions to add it to ubcd4win or bartpe)
• Anti-rootkit (be careful with them, use one at time, and uninstall them after using, and don't remove everything they found!):
  • GMER
  • RootkitRevealer
  • Rootkit Unhooker