Hello All,
It seems my box got infected with the variant of MAX++ ( I realized this too late, otherwise I would not have deleted consrv.dll)
System: Vista Ultimate 64 bit, Avast, Comodo firewall only
Symptoms:
Existence of windows\system32\consrv.dll
During full scan Avast found C:\Windows\assembly\TMP\kwrd.dll
svchost was trying to get some URL, which was blocked by Avast on several occasions
I deleted consrv.dll and setup for the boot-up scan.
At boot up scan Avast found:file C:\Windows\assembly\tmp\U\80000032.@ is infected by Win32:DNSChanger-VJ [Trj] and moved to chest
also : File C:\Windows\assembly\tmp\U\00000002.@|>[Embedded_R#00290] is infected by Win32:Malware-gen and moved to chest
After restart - cannot start OS. I tried safe mode - hangs after crcdisk, BartPE - throws BSoD. Was not able to repair installation as well.
Is there any way the system can be restored with the virus removed, short of wiping out the disk and doing new install?
Unfortunately that files replaces a system service within the registry - so if you do not change the registry key as well then the system will fail to boot
If none of the system recovery options work then let me know and I wil try a repair outside of windows
I am not able to get to the safe mode - system reboots. Tried to get to repair using original installation disk - got the error: Invalid Disk.
Tried to undelete consrv.dll using TestDisk from UltimateBootCD. TestDisk did not find consrv.dll file. All it found was C:\Windows\assembly\tmp\U\80000032
essexboy, if I am able to get to registry from outside of windows, what do I need to fix? Is there any other way to fix it?
OK next we will work outside of windows then Please print these instruction out so that you know what you are doing
[*]Download OTLPENet.exe to your desktop
[*]Ensure that you have a blank CD in the drive
[*]Double click OTLPENet.exe and this will then open imgburn to burn the file to CD
[*]Reboot your system using the boot CD you just created.Note : If you do not know how to set your computer to boot from CD follow the steps here
[*]As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
[*]Your system should now display a Reatogo desktop.Note : as you are running from CD it is not exactly speedy [*]Double-click on the OTLPE icon.[*]Select the Windows folder of the infected drive if it asks for a location
[*]When asked “Do you wish to load the remote registry”, select Yes[*]When asked “Do you wish to load remote user profile(s) for scanning”, select Yes
[*]Ensure the box “Automatically Load All Remaining Users” is checked and press OK
[*]OTL should now start
[*]Drag and drop this attached scan.txt into the Custom scans and fixes box, or double click the scan box
[*]Press Run Scan to start the scan.
[*]When finished, the file will be saved in drive C:\OTL.txt
[*]Copy this file to your USB drive if you do not have internet connection on this system
[*]Right click the file and select send to : select the USB drive.
[*]Confirm that it has copied to the USB drive by selecting it
[*]You can backup any files that you wish from this OS
[*]Please post the contents of the C:\OTL.txt file in your reply.
OK lets reset the registry key and hopefully you will be back in windows
Start OTLPE as you did previously from CD
Copy the attached Fix.txt to a USB
[*]Insert your USB drive with fix.txt on it
[*]Start OTLPE
[*]Drag and drop fix.txt into the Custom scans and fixes box
[*]If you cannot drag and drop for some reason. Then press the Run Fix button and a dialogue box will pop up asking for the location - select the file on your USB drive
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot when it is done to normal mode if possible
[*]Then post a new OTL log ( don’t check the boxes beside LOP Check or Purity this time )
On attempt to drag and drop OTLPE responded " not a valid fix file". I copied and pasted the text. It seems now, the fix stuck in processing registry data "Debug=hex(2):00,00
CRCDISK.SYS identifies itself as a "Disk Block Verification Filter Driver" and was written by Microsoft. It does CRC checking on data being read off the disk.
Unfortunately it is quite slow as it needs to check all sectors on your drive. The above is an explanation of what that file does
I just checked and there is still windows/system64 directory exists ( which I renamed to rename_system64_rename ). It has files with the identical names to the files in system32 and syswow64, but different timestamp. Can this prevent me from running sfc /scannow?
