Author Topic: Format C drive to remove malware and other problems  (Read 6481 times)

Offline man99

  • Newbie
  • *
  • Posts: 16
    • Personal Message (Offline)
Format C drive to remove malware and other problems
« on: December 26, 2009, 08:29:40 AM »
Hello everyone,

My PC has been infected with siszyd32.exe and some trojans and malware. Some passwords are stolen.

These are the scans I did and the items found.

Scanned with Malwarebytes AntiMalware
Vendor> Trojan.Agent        Items> siszyd32.exe
Vendor> Malware.Trace     Items> avdm.dat

Scanned with SuperAntiSpyware
Trojan.Agent/Gen     Files> C:\WINDOWS\TEMP\~TMCA.TMP
Trojan.Agent/Gen-Nullo[Short]     Files> C:\SYSTEM VOLUME INFORMATION\_RESTORE...............

Scanned with AVG
File>C:\Program Files\Internet Explorer\iexplore.exe (5060);\memory_00400000     Infection> Trojan horse PSW.Agent.AAJK
File>C:\Program Files\Internet Explorer\iexplore.exe (5060)     Infection> Trojan horse PSW.Agent.AAJK

I decide to reformat the PC to remove all malware.

Some questions

1) Does reformating the C drive (windows) kill all virus/trojans/rootkits?

2) My PC has 3 hard disks,  Hard disk 1 is formatted into 3 partitions, 1st partition is C: is where windows is installed, the 2nd and 3rd partition contains data files (pdf, doc, excel, music...). The 2nd and 3rd hard disk contain data files.
I will format the C: and reinstall windows only, is it enough to kill all viruses/trojans?
Will trojans hide inside data partitions or somewhere else besides the C:?

3) Does anyone know what other data might be stolen?

4) Can the trojan steal passwords that I have typed into the browser before my PC is infected? Or the trojan can only steal the passwords that I have typed after my PC is infected?

5) When I am offline (modem is off), does the rootkit/virus still works, capturing passwords and keystrokes. After that when I am online, it will start to send data (captured during offline) to the hacker?

I appreciate all help and suggestions. Thanks in advance.
« Last Edit: December 26, 2009, 11:28:10 AM by man99 »

Offline YoKenny

  • Serious Graphoman
  • **
  • Posts: 8800
  • Gender: Male
    • Personal Message (Offline)
Re: siszyd32.exe and other problems
« Reply #1 on: December 26, 2009, 09:17:59 AM »
E5200 2.5GHZ, 4GB RAM, 320GB HD, Windows 7 Home Premium 64bit, avast! V9.0 Free, IE10
P4 2.8GHZ, 1.5GB RAM, 40GB HD, XP Pro SP3 32bit, avast! V9.0 Free, Google Chrome
with hpHosts, MVPS HOSTS files, SpeedFan, WinPatrol PLUS

Offline man99

  • Newbie
  • *
  • Posts: 16
    • Personal Message (Offline)
Re: siszyd32.exe and other problems
« Reply #2 on: December 26, 2009, 09:47:57 AM »
Hi YoKenny,

I did search for siszyd32 and read through all related threads before creating this thread. Those threads are talking about scanning the malware with softwares. They did not mention about reformatting PC to cure the virus.

My questions are related to reformatting the PC to cure the malware and how the malware works.

Offline CharleyO

  • avast! Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7102
  • Gender: Male
  • Be alert for error code - ID 10T
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #3 on: December 27, 2009, 09:04:07 AM »
***

If the malware is only on C drive, reformating C drive would help. But, how do you know if the malware is only on C drive? If the malware has spread to the other 2 drives, reformating C drive only will not help.


***
Self-built desktop (8 years old) - AMD64 3200+_Gigabyte GA-K8NS Ultra-939_4 gb RAM_GeForceFX 5800w/256 ram_XP/SP3_Avast 7_MBAM_ZA Free __and__ Toshiba Satellite Laptop_W7-64bit_ 4 gb Ram_Avast 8_MBAM

Offline man99

  • Newbie
  • *
  • Posts: 16
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #4 on: December 28, 2009, 02:41:14 AM »
I am assuming the malware is on C: because the scans shows problems on C:

How can I check if there is malware in the other 2 drives?

Sometimes malware can also hide in boot sector, CMOS, BIOS? How do I check if there are malware in these areas?

Thanks

Offline jeffj4873

  • Jr. Member
  • **
  • Posts: 80
  • Gender: Male
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #5 on: December 28, 2009, 03:22:55 AM »
Make sure to have run Boot scan on all drives. This will ensure bios is clear. Actually if you have the time, you would do better to try to kill off the trojans first and possibly malware then reformat c:
At least the easy to kill ones. Less chance of spread if there are less contaminated files.

Offline man99

  • Newbie
  • *
  • Posts: 16
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #6 on: December 28, 2009, 05:06:25 AM »
What kind of boot scan do you mean? How do you do it?

I scanned all drives with the programs as as stated in the first post and deleted all the virus found. Currently doing avast scan and this should be my last scan before I format my PC. I have been doing scans for 3 days and I wonder if I am wasting my time because all malware should be removed if I do a reinstall of C drive.

I intend to scan all drives another time after I have reinstalled C drive. I wonder if I should have straight away do a reinstall of C drive and then do a scan of all drives to detect malware so I can save some time.
« Last Edit: December 28, 2009, 06:36:08 AM by man99 »

Offline emantoyaks

  • Full Member
  • ***
  • Posts: 139
  • Gender: Male
  • Malware Expert...^_^
    • My Personal WebSite!
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #7 on: December 28, 2009, 06:57:00 AM »
can u try malwarebytes.org to remove that malware? ...
My Skills:

* Trouble Shooting
* Web Development
* PC Hard Ware Analyst

Offline man99

  • Newbie
  • *
  • Posts: 16
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #8 on: December 28, 2009, 08:22:49 AM »
emantoyaks, I have already scanned my PC with malwarebytes as mentioned in my first thread.
« Last Edit: December 28, 2009, 08:26:42 AM by man99 »

Offline CharleyO

  • avast! Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7102
  • Gender: Male
  • Be alert for error code - ID 10T
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #9 on: December 28, 2009, 04:55:55 PM »
***

How to do a boot time scan:

http://www.digitalred.com/avast-boot-time.php


***
Self-built desktop (8 years old) - AMD64 3200+_Gigabyte GA-K8NS Ultra-939_4 gb RAM_GeForceFX 5800w/256 ram_XP/SP3_Avast 7_MBAM_ZA Free __and__ Toshiba Satellite Laptop_W7-64bit_ 4 gb Ram_Avast 8_MBAM

Offline man99

  • Newbie
  • *
  • Posts: 16
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #10 on: December 29, 2009, 03:05:22 PM »
Does anyone know how to do a boot sector scan? From my understanding, a boot time scan is similar to the normal avast scan inside windows, except that a boot time scan is done before windows is loaded.

Malware may hide in boot sector / CMOS / BIOS, so I would like to know how to scan boot sector.

Offline RNfromTN

  • avast! Evangelist
  • Advanced Poster
  • ***
  • Posts: 668
  • Gender: Male
  • surfin sandboxed
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #11 on: December 29, 2009, 05:50:16 PM »
Does anyone know how to do a boot sector scan? From my understanding, a boot time scan is similar to the normal avast scan inside windows, except that a boot time scan is done before windows is loaded.

Malware may hide in boot sector / CMOS / BIOS, so I would like to know how to scan boot sector.

Hi, this is a specialized tool for scanning boot sector viruses. http://www.softpedia.com/get/Antivirus/Avira-Boot-Sector-Repair-Tool.shtml  hope this helps
Sandboxie| IFW|Outpost firewall|Norton Ghost|Win XP,Vista,7
member since 2005| Linux Mint user

Offline Gizbar

  • Jr. Member
  • **
  • Posts: 74
  • Gender: Male
  • So long and thanks for all the fish!
    • Personal Message (Offline)
Re: Format C drive to remove malware and other problems
« Reply #12 on: December 29, 2009, 06:03:44 PM »
Hi man99,

You'll probably find that most malware does not install itself in the boot-sector, or BIOS or CMOS any more. The virus/malware writers have moved on from that.

Malwarebytes' Antimalware should clear it up, as long as you have the latest definitions. Avasts' boot-time scan scans the disks before windows starts as the malware stores info about itself in the registry, and therefore initialises as windows runs. The boot scan stops this, but will only currently work on 32-bit windows installs.

Formatting drive C: will get rid of any entries in the registry so your machine will not be infected, but it will not clear any files that are resident on your other drives. If you choose to re-install windows, then you will still need to do a scan to get rid of these malware files off of your disks.

Unfortunately, it can be a long process, and as long as you have all your data backed up, it may be quicker and easier in the long run to format C: and re-install windows.

regards, Gizbar.
Phenom II 955 @ 3.6Ghz, 4GB Ram, Win 7 64-bit HP
2 x 500GB HD, Firefox 3.5, Avast! 5 Free. Ccleaner, Spybot S&D 1.6.2, MBAM free

 

Google Chrome

AVAST recommends using the FREE Google Chrome™ browser.

Download Google Chrome Now