IWETHEY v. 0.3.0 | TODO
1,095 registered users | 0 active users | 0 LpH | Statistics
Login | Create New User
IWETHEY Banner

Welcome to IWETHEY!

New Re: It's getting very rough out there.
If you look with allocation tools like fdisk, there's usually about 8 megs of unalocated space. That's where the infection would place its file system.

Kaspersky's tdsskiller utility is supposed to detect these infections and clean them up. Haven't tried that yet, because I got this one by another means. Only by doing so was I able to find out what to look for to fix it.

I ran Combofix in Safe Mode. It found root kit activity as usual and started its special reboot for clean-up (which doesn't work in this case). I killed the reboot, booted into Recovery Console and replaced the MBR using fixmbr (which runs only from the recovery console). I then rebooted into Safe Mode. The startup was intercepted by Combofix as usual but this time it detected TDS4 infection and killed it.

I don't know if fdisk would cure this problem - it might, but it might not. If I really wanted to be sure, I'd hook the drive to another system and use a disk editor to overwrite the whole MBR with $00.

New dd if=/dev/zero of=/dev/hda bs=1048576 count=1024
That will get past the 1024 limit just fine... Though 100MB should be fine.
New Re: dd if=/dev/zero of=/dev/hda bs=1048576 count=1024
That's exactly what I thought of when I read Andrew's post.

God, I've become a Unix junkie. What has happened to me? ;)
New Hey... you see that... +
That is the world's smallest digital violin playing for you.
     It's getting very rough out there. - (Andrew Grygus) - (11)
         Joy. - (Another Scott)
         Malware is one of the things that drove me off Windows. - (static) - (1)
             Well, it may drive more off. - (Andrew Grygus)
         Re: It's getting very rough out there. - (Ashton) - (5)
             It shouldn't - (scoenye)
             Re: It's getting very rough out there. - (Andrew Grygus) - (3)
                 dd if=/dev/zero of=/dev/hda bs=1048576 count=1024 - (folkert) - (2)
                     Re: dd if=/dev/zero of=/dev/hda bs=1048576 count=1024 - (jake123) - (1)
                         Hey... you see that... + - (folkert)
         Sound a lot like.. - (folkert)
         It does have some virtues... - (scoenye)

Calculate projected nexus.
170 ms