Win32:Bamital-X and Whistler-B@mbr (Rtk)

[essexboy]

Lets go for the tatties 

[Miko77]

Heya, here is the combofix file.

[essexboy]

Looking at that it may be that SFC cleared it.  One of the joys of a 64bit windows 7

What are your current problems ?

[Miko77]

Just ran a full system scan and Avast says its still there. In Disk 0 Master Boot Record thats the  Whistler-B@mbr (Rtk) is there any way that I can include a log of the Avast scan to be looked through?

[essexboy]

OK could you re-run aswMBR  please - are you getting the bamital alert ?

[Miko77]

Here is the new scan. Thanks for your help again I hope it gets fixed soon as I dont want to take up too much of your time, do you think I should just take the computer into a shop and get them to have a look at it?

[essexboy]

Intriguing - dependant on the result of this I may need a copy of the aswMBR dat

Please read carefully and follow these steps. 

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
   
   
  
   
   
  
• If an infected file is detected, the default action will be Cure, click on Continue.
   
   
  
   
   
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
   
   
  
   
   
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
   
   
  
   
   
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  

[Miko77]

Here's the log

[essexboy]

THat got it could you send the file mbr.dat to GMER (I will PM the address) as there is an error there somewhere - did TDSSKiller clear it after reboot ?

[Miko77]

Yay woohooo thanks it definetely appears to have gone. Cheers for all your help and time its greatly appreciated I will send u the data thingy too

[essexboy]

That is the one advantage of having a 64 bit windows 7 - the security setup makes it very easy for windows to replace infected 32 bit files



I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

 Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Commands
  [resethosts]
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

Click Start > Run  and copy/paste the following bolded text into the Run box and click OK: 

ComboFix /Uninstall

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

SPRING CLEAN

To manually create a new Restore Point

• Go to Control Panel and select System
  
• Select System
  
• On the left select System Protection and accept the warning if you get one
  
• Select System Protection Tab
  
• Select Create at the bottom
  
• Type in a name i.e. Clean
• Select Create

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools page
  
• Select Performance Information and Tools
  
• Right click Disc cleanup an select run as administrator
  
• Select Your main drive and accept the warning if you get one
  
• For a few moments the system will make some calculations
• Select the More Options tab
  
• In the System Restore and Shadow Backups select Clean up
  
• Select Delete on the pop up
  
• Select OK
• Select Delete

Final stretch

 
Download and run Puran Disc Defragmenter
For the first run I would recommend a boot defrag and disk check




Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
 
Malwarebytes.  Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update
  

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?
Keep safe  :wave:

[ZCooper]

So I've recently had an encounter with Win 32 Bamital X... I ran ComboFix (please see the attached log), and while Essexboy says it appears that the problem's been rectified and cleaned, it still comes up in 3 parts on my Avast scan.

Can you please help?
Thanks.

[essexboy]

The fix for Miko77 would probably not work for you as each system and infection is different

Could you post the Avast report please with the problem files and locations

Download OTS to your Desktop and double-click on it to run it

• Make sure you close all other programs and don't use the PC while the scan runs.
  
• Select All Users
  
• Under additional scans select the following

Reg - Disabled MS Config Items
Reg - Drivers32
Reg - NetSvcs
Reg - SafeBoot Minimal
Reg - Shell Spawning
Evnt - EventViewer Logs (Last 10 Errors)
File - Lop Check

• Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
  
• When the scan is complete Notepad will open with the report file loaded in it.
• Please attach the log in your next post.

[ZCooper]

I just ran the scan again, and for whatever reason I was able to send the viruses (down to 2 parts) to the chest.
Odd, but I'll take it.

I'm going to run the boot scan again... and if I should encounter any further problems, I'll bring it to your attention.
Thank you for the help!