Win32/mebroot Trojan can't clean????

Scan pulled up this little guy but cannot clean it. It seems to have done something to the sound capability, nothing is now working, no sound and the volume buttons also are now not making the pretence of working which they initially did.

I have tried to use the ESET mebroot fix to no avail and have also been dealing with ESEt support but haven't heard back since the first contact (guessing they did not get my reply).

Doesn't seem like I have any other problems, well major ones, but would love some help getting rid of the bug asap and getting my sound capability back.

I have included the combo fix scan that was requested by ESET support.

Someone please help, this is getting annoying.

 

You can read this first, it might help.
https://www.wilderssecurity.com/showpost.php?p=1533481&postcount=3

 

There is a removal tool at this Link

Would you point to exact URL where you obtained the above removal tool ? The exact link is here

Who at ESET support informed you that ComboFix would remove this infection, if it does not target this type of infection, use of it is moot.

Try running a full scan in Safe Mode, post back your findings.

Regards,

 

Took the trojan fix from that exact spot from ESEt site, but doesn't clean, or atleast is unable. Basically says new version of MBR root kit found unable to clean.

Will run the ESET scan in safe and let you know?? I was under the impression that the combo fix would give details only, so if Manny from ESET thought that it would solve the problem I would be surprised, but you never know.

Will post asap.

Thanks

 

Scan log is attached.

On restart from safe mode ESET also pulled up the following:
6/27/2010 1:04:31 AM Startup scanner file C:\System Volume Information\Microsoft\smss.exe a variant of Win32/TrojanDownloader.Unruy.BV trojan cleaned by deleting (after the next restart) - quarantined
6/27/2010 1:03:00 AM Startup scanner file C:\System Volume Information\Microsoft\services.exe a variant of Win32/TrojanDownloader.Unruy.BV trojan cleaned by deleting (after the next restart) - quarantined
But did not clean on restart as it was there again.

Let me know and again I really appreciate the help.

 

That's in your restore points so disable system restore and reboot your rig. After windows loads, create a new restore point and all should be gone.

 

It would appear the Safe Mode Scan has managed to quarantine the files at issue. Meanwhile, someone from ESET has to read your attached scan log file to determine if you are good to go or not.
Also, as suggested in this thread, do not flush your System Restore Archive, you do not want to do this unless instructed to do so by someone that I qualified to do so.

 

The problem is all still there and now there is the other as mentioned above. The help from ESET is not particularly helpfull, I first contacted them a week ago. Any other ideas?

 

Download Backdoor.Win32.Sinowal.deg killer from here (KL) Read instruction "How to use" here

If you found that it doesn't helps then try this removal tool http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/

 

You could wait for someone for ESET to verify your safe mode scan log, or, submit an issue ticket online to ESET Call the person that you spoke with at ESET back, I would do the latter to expedite your issue.

 

NEver heard back from ESET, so have had no real contact from them in two weeks when the original issue ticket was submitted.

Anyone have any ideas.

 

If you're logged in as an admin with r+w permissions to the C:\System Volume Information folder, scan it in safe mode or better create a rescue media and run a full disk scan from there. Also enclose the threat log and the respective on-demand scanner log with Mebroot detection; it's not clear if it was detected in MBR or only in files (ecls doesn't scan boot sectors by default, you need to use the "/boots" parameter).
Is the Mebroot infection reported also in SysInspector logs?
What message does the stand-alone Mebroot removal tool return?

 

If you come across a problem removing Mebroot using the stand-alone ESET Mebroot cleaner, create a complete memory dump per the instructions here and let me know when done.

 

It's a MBR infected virus.

XueTr could detect and fix it.

But in my test, Partition Table was broken after xuetr fix it.

So I reboot in PE and use Partition Table Doctor rebuild the Partition Table.

then reboot ,all is ok.

 

We are awaiting a reply from the OP as per last request from Marcos here

 

Don't have the option of full system dump, only small and kernel, what would you like me to do??

 

Send a private message to Marcos advising him you wish further instructions.