Cannot delete Trojan.Unruy in system volume information

[rhutami]

the quick scan required reboot. it found 3 trojan : trojan.hashish.1 (at master boot, and 2 trojan.siggen1.30114.

What next step i have to do? since that quick scan required reboot... do i need to redo that step?

[rhutami]

Oh I forgot to added: to cure trojan.hashish.1 (at master boot) my computer has to reboot immediately (it kinda scary, black screen after i click OK)

2 trojan.siggen1.30114 (which C:\System Volume Information\_restore{d5fffa500b1b}\svchost.exe & smss.exe cure in process., now I do the quick scan again... hopefully I can follow the next step as your instruction.

Thanks!

[rhutami]

Hi Borislav, I guess you went to sleep already... I just run the complete scan now. I finished 2nd quick scan, came out clean... I hope the complete scan result will be clean also...

Is this drweb-cureit.exe is safe for my other computer? I wonder if actually I should check my main computer and my laptop too.... so far i check with Malwarebytes the result is clean, also antivirus... but is it really clean?

Thanks! Have a good nite sleep and see you tomorrow

[Maniac]

I hope, rhutami, I hope....

Please update your MBAM and perform a quick scan to check what is the situation.

[rhutami]

I hope, rhutami, I hope....

Please update your MBAM and perform a quick scan to check what is the situation.

Hi Borislav, unfortunately I have to go to office today, so I cannot finished the full scanning today, as soon I get home I will do it again... this Dr. Web is really good...

Talk to you later!

Rachel

[Maniac]

Don't worry!

Have a nice day, Rachel!

[tomZ]

Hi all,

I had the same problem (coming under a different name but with the exact same path and infected files & the same difficulties in getting rid of).

The solution for me was bootkit remover (http://www.esagelab.com/files/bootkit_remover.rar)

You can run it to check if a problem might be in the MBR, then, if there is, fix it with the same program.

Greetings,

tom

[rhutami]

Don't worry!

Have a nice day, Rachel!

Hi Borislav!

I (finally) did and finished the complete scan with Dr. Web, it came out CLEAN!!!! Yippieeeeeeee!!!!

What is next step I need to do?

Is Dr. Web CureIt is safe if I run at my other computers? Thankyou

Rachel

[Maniac]

Good work, Rachel!

Let's check:

• Launch Malwarebytes' Anti-Malware
  
• Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  
• Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

[rhutami]

Hi Borislav,

I check with Mbam, here the result:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4152

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/28/2010 3:24:02 PM

mbam-log-2010-05-28 (15-24-02).txt

Scan type: Quick scan

Objects scanned: 158929

Time elapsed: 6 minute(s), 45 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Maniac]

Awesome Rachel!

Last steps:

Step 1

* Go to start > run and copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Step 2

To enable CD Emulation programs using DeFogger please perform these steps:

1. Please download DeFogger to your desktop.
   
2. Once downloaded, double-click on the DeFogger icon to start the tool.
   
3. The application window will now appear. You should now click on the Enable button to enable your CD Emulation drivers
   
4. When it prompts you whether or not you want to continue, please click on the Yes button to continue
   
5. When the program has completed you will see a Finished! message. Click on the OK button to exit the program.
   
6. If CD Emulation programs are present and have been enabled, DeFogger will now ask you to reboot the machine. Please allow it to do so by clicking on the OK button.
   

Step 3

Please manually delete DDS, GMER, RootRepeal, Rootkit Unhooker and Dr.Web CureIt.

Step 4

Please uninstall ESET Online Scanner.

Step 5

Some malware preventions:

http://miekiemoes.blogspot.com/2008/02/how...nt-malware.html

Safe surfing!

[rhutami]

Hi Borislav, I am soooooooooooooo grateful with all help from you!!!! You r so great! Thank you so much!!!

Best,

Rachel

[Maniac]

You're welcome, Rachel!