I don’t actually have this virus myself, but a friend of mine does and I promised to help him. I’m not a computer expert by any means, but I’ve been able to help him with different pc-related problems in the past. This is beyond me, though, so I hope someone here can help.
He’s running avast 4.8 home edition, and from what he’s told me, it keeps finding this virus, but whether he deletes it or moves it to the vault, it keeps coming back. We tried some online scanners, but they didn’t help at all. From what research I’ve done on these forums and others, it seems like this virus is very difficult to get rid of, but hopefully someone here will be able to help.
[]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
[]Under the Custom Scan box paste this in
Alright, thanks to you both. I don’t have access to the pc right now, but I’ll post the info as soon as possible. I really appreciate that you’re taking your time to help.
I hope this is correct. One thing I noticed during the scan, though, is that at some point it looked for newly created files. My friend tells me that his problem started a couple of weeks ago, so the infected files may not be brand new. I don’t know if this is important, but there it is.
Anyway, I’ve managed to appropriate my friends pc, so I should be able to respond faster from now on.
OK here we go this will be a fairly long fix so take note of the steps as they must be done in order
@echo off
copy C:\Program Files\Intel\Intel Matrix Storage Manager\driver\iastor.sys c:\
exit
First you will need to create the batch fix to do that copy and paste [b]ALL[/b] of the above in the quote box to a notepad file.
Then in the text file go to [b]FILE > SAVE AS [/b] and in the dropdown box select [b]SAVE AS TYPE [/b] to[b] ALL FILES [/b]
Then in the [b]FILE NAME [/b] box type [b]fix.bat[/b]
Then run fix.bat by double clicking you may see a black box appear this is normal
Please downloadThe Avenger2 by Swandog46 to your Desktop.
[*]Right click on the Avenger.zip folder and select “Extract All…”
[*] Follow the prompts and extract the avenger folder to your desktop
Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Begin copying here:
Files to move:
C:\iaStor.sys | C:\Windows\System32\drivers\iaStor.sys
Files to delete:
C:\Windows\System32\tdlcmd.dll
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
Now, open the avenger folder and start The Avenger program by clicking on its icon.
[*] Right click on the window under Input script here:, and select Paste.
[*] You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
[*] Click on Execute
[*] Answer “Yes” twice when prompted.
The Avenger will automatically do the following:
[*]It will Restart your computer. ( In cases where the code to execute contains “Drivers to Delete” or “Drivers to Disable”, The Avenger will actually restart your system twice.)
[*]After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
[*] The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
Please copy/paste the content of c:\avenger.txt into your reply [b].
FINALLY
Download Combofix from any of the links below. You must rename it before saving rename it to Nikolajwa before saving it to your desktop.
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows Vista
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Error: file “C:\iaStor.sys” not found!
File move operation “C:\iaStor.sys|C:\Windows\System32\drivers\iaStor.sys” failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
→ the object does not exist
I tried running combofix, but it tells me that I should shut down avast before continuing. I tried disabling the on-access protection, but combofix still complained that avast was running. Should I just ignore this, or is there some way to completely shut down avast?
I also have tdlcmd.dll and cannot get rid of it. My avast lets me delete it, but it keeps coming back. I have also tried PrevX, malwarebytes, spybot search and destroy. My computer seems to work ok, but I can no longer even go into safe mode.
I saw you post to a guy with a similar problem, but you said your solution was specific to him. Is there anyway I can get your help?
[*]Close ALL OTHER PROGRAMS.
[*]Double-click on OTS.exe to start the program.
[*]Check the box that says Scan All Users
[]Under Additional Scans check the following:
[]Reg - Shell Spawning
[]File - Lop Check
[]File - Purity Scan
[]Evnt - EvtViewer (last 10)
[]Under custom scans copy and paste the following
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
/md5stop
%systemroot%*. /mp /s
c:$recycle.bin*.* /s
CREATERESTOREPOINT
[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
