MBR:Sinowal [Rtk]

Viruses and worms
1

After foolishly installing something I should not have, I ended up with the “Start Savin” extension on my browser. I downloaded Avast to take care of that, and it found the following:
MBR: \.\PHYSICALDRIVE0\Partition2 Severity High Status Threat: MBR:Sinowal [Rtk]

It can neither fix automatically, nor move to chest, nor repair, nor delete. Malwarebytes took care of sundry problems associated with Start Savin, but this issue remains.

I’ve attached all of the logs I’ve run, and I can add a ComboFix log if necessary; let me know if you need anything more.

Thank you so much for your assistance!

2

Hi two programmes to run. You will need to decide whether to keep Norton or Avast as only one AV is good

Download the latest version of TDSSKiller from here and save it to your Desktop.

[*]Doubleclick on TDSSKiller.exe to run the application

https://dl.dropbox.com/u/73555776/tdss%20start.JPG

[*]Then click on Change parameters.

https://dl.dropbox.com/u/73555776/tdss%20Change%20param.JPG

[*]Check the boxes beside Verify Driver Digital Signature, Detect TDLFS file system and Use KSN to scan objects , then click OK.

[*]Click the Start Scan button.

[*]If a suspicious object is detected, the default action will be Skip, click on Continue.

https://dl.dropbox.com/u/73555776/tdss%20threat.JPG

[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

[*]Get the report by selecting Reports

https://dl.dropbox.com/u/73555776/tdss%20report.JPG

[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

Please attach its contents on your next reply.

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

3
You will need to decide whether to keep Norton or Avast as only one AV is good
Why Using Multiple Antivirus Programs is a Bad Idea https://blog.kaspersky.com/multiple-antivirus-programs-bad-idea/