Malware cannot be removed from Harddisk

[ajumelet]

Hello Computer forum,

At present many new malicious software are active, now for two weeks ago I got
a virus which is not removal by the usually tools and procedures as mentioned. I
suspect this type of virus is one of the most dangerous I have ever had. My
computer itself is in topcondition. I also used GMER rootkit detection/removal
newest version 1.015 with no results.


Please let me explain what I have done before:
For clearing the virus can escape and executing in more identities and can not be
dectected by Anti-virus application Norton Internet Suite 2011 which is up to
date, Strongly speaking it manipulates with this program which I can not be trusted
any more. I can as usually work on my computer but with some differencies. (virus identities)
1e) manipulating with WindowXP SP3 settings such as: colors, textsize, messages like “new program installed” in start-menu (every time) and much more….,
2e) On internet it manipulates chosen webpages like textsize, reclames, icons, pictures. Scrollbars…
3e) At turn on it can manipulate the bootprocecure.
4e) it can manipulate with download utilities to use its own settings or using slightly
different instruction the utility execute.
5e) it also manipulates with my Norton Internet Security which is running constantly

The following procedure on the highest level (extremity overkill) are described with no results: The floppy’s are clean and write-proctected.

1) turn-off computer (5 min.)
2) putting out the internet and powercable and remove the cmos battery.
3) disconnecting HDD from sataport
4) connect the usb-floppy with biosfile
5) turn on computer (without battery)
6) change bootsequence: 1 usb-floppy, 2 disabled 3 disabled
7) save biossettings
8) rebooting to the postscreen using F8 for the Flash utility (Gigabyte P35-dq6)
9) reading and updating the bios
10) after bioscomplete and before rebooting, turn off computer (see point 1,2 (except internetcable.))
11) turn on computer (without battery) and change again biosettings 1e usb-floppy 2 disabled 3 disabled
12) save biossettings
13) rebooting again to usb floppy with (Vendor seatools for full-zero filled)
14) after completed it takes 3 hours)
15) rebooting to change again the bootsequence: 1 usb-floppy, cdrom, 3 HDD
16) save biossettings.
17) Rebooting to the CD WindowsXP installation.
18) Installing a fresh WindowsXP (fixmbr (in case that), new partition, full format)
19) After installation was completed and I got my windows startscreen I did some tests if it is clean.

After that I also tried another procedure with NONE BIOS-DETECTING TO HDD with no results!!:

Step
01) Computer turned off
02) Internet en Powercable unplugged.
03) Satacable unplugged from SataController.
04) Turn-on computer after 5 min.
05) Biossettings: 1 USBfloppy 2 disabled 3 disabled
06 Reboot to USBfloppy (with Manufacturer’s Seatools)
07) After I accepted the license agreement from Seatools, I plugged-in the HDD into Sataport
08) Seatools detects the HDD and executed the full-zero filled operation.
09) After the operation I turned off the computer without Powercable for 5 min.
10) Turn-on the computer
11) bootsequence: 1) Cdrom, 2) disabled 3) disabled (note: HDD still disconnected)
12 reboot to installation-CD Winxp Pro
13) Now I let windows setup detecting my HDD
14) create new partition and full format. (FIXMBR also used)
15) During the installation, windows copies the systemfiles, suddenly the installation breakdown because
of the message said “windows cannot copy the file xxxxxxx? try again, reboot or make sure that the CD
is in the cddrive. I have installed many window-installations with the same cd and no problems were appeared.


I was very shocked that above procedures help nothing to remove that nasty one
I believe it is a FlashBios rootkit and possible also a MBR rootkit.Why? I have
connected an old IDE HDD (clean) to install Windows (the same procedures as
asbove) but with no results. The most important is the startup sequence (starting
from turn-on computer until the moment the bios boot to the MBR. If in that
timeperiod no interaction (during the POST) from user is possible than the rootkit
can be transferred to memory but also biosroutine instructies are in memory.

Possible it can adhere to those biosinstructies, a way to convert the bios with its
own one. Of course memory dumps, binaries, datastructures, interupt vectors,
comparing tools are possible to discover it but its very complicated and a
lot of time consumed.Hotflash is no option for me it takes too much time to search,
adver the same/compatible chipset P35 Its als too old.The only way is forensic
analysis, that costs to much time and money for me. So if nobody can help me,
then I decide to buy a old new motherboard P45 and HDD’s

Thanks in advance

 

[VirtualLarry]

It sounds like your install CD is scratched, or your HD is failing, if Windows Setup is throwing error messages about copying a file. That doesn't sound like a virus.

Or perhaps you are overclocked, overheating, or your RAM is defective.

It could even be a bad PSU.

 

[Fardringle]

I was going to suggest RAM or CPU but Larry beat me to it. Try running MEMTEST from a boot CD (you might need to let it run for several hours) to check for memory problems.

 

[ajumelet]

Thanks for your reply, The problem is not the Memory its ok, I know for sure that the install breakdown the virus caused. one week ago i did
the same installation with no problems, being aware that the system
was infected, without the procedure as described above. (on a normal way).

 

[ajumelet]

It sounds like your install CD is scratched, or your HD is failing, if Windows Setup is throwing error messages about copying a file. That doesn't sound like a virus.

Or perhaps you are overclocked, overheating, or your RAM is defective.

It could even be a bad PSU.

Thanks for your replay
As i said my computerhardware is in topcondition, also HDD, no overclocking activities , i use my computer on a normal way, see also my reply to Fardringle.

 

[dac7nco]

Thanks for your replay
As i said my computerhardware is in topcondition, also HDD, no overclocking activities , i use my computer on a normal way, see also my reply to Fardringle.

The funny thing about computer hardware, is that failure of components is almost never visible or detectable without a lot of trial and error. Try flashing your BIOS with a USB image. If your computer is too old for that, use a floppy. If the problem persists, it is hardware only.

I like that you use your computer in a normal way, LOL. I use mine as a stove.

Daimon

 

[ajumelet]

The funny thing about computer hardware, is that failure of components is almost never visible or detectable without a lot of trial and error. Try flashing your BIOS with a USB image. If your computer is too old for that, use a floppy. If the problem persists, it is hardware only.

I like that you use your computer in a normal way, LOL. I use mine as a stove.

Daimon

Thanks for your reply,

As described in the above procedure I have done bios flashing on floppy.
USB-stick flashing is also possible its only another medium it has no added value.

 

[Fardringle]

When you did the full zero write on the drive, that completely wiped out the MBR so there couldn't be a virus still hiding there unless you didn't really do the full zero write, or you did something to get the virus back after wiping the drive.

While it is possible for a virus to infect the system BIOS, it is very rare, and for a BIOS virus to do what you are describing is virtually impossible. I'm making up numbers, but only slightly exaggerating when I say that the symptoms you describe have a 99.99% chance that they are caused either by a corrupted Windows installation (you eliminated that by wiping the drive) or by hardware failure. The other 0.01% is a generous (high) estimate of the likelihood that it is a virus after everything else that you have done.

 

[classy]

First off, whenever you struggle to clean any virus on a OS while booted, if you can pull the drive and connect it to another pc as an additional drive and scan it that way.

Your message is more than likely one of several things, bad hard drive, bad motherboard (ports are failing), bad cdrom drive, or bad media. As some of the guys have already mentioned.

Set your bios to default values.
Connect all your drives including your hard drive.
Download and use either kill disk or dban to wipe the drive. You can zero fill as well with seatools, works just the same. With Dban if it can detect your hard drive, doing a DOD short will provide an even more thorough clear.
Then boot to your XP Disk and let XP setup and format the drive. Just choose quick setup since you'll have done a clear on the drive.
If it fails, try a another CDROM drive first, then new media. If it fails again, I would say you have a bad motherboard. IDE ports are failing.
But just make sure you setup motherboard bios to defaults. Clear the CMOS!!!!!!

 

[classy]

The virus you are describing was likely malware, java related. Most virus programs won't work in those situations. You need to use malware detecting programs like Malwarebytes, Search and Destroy, or Super AntiSpyware.

 

[ajumelet]

When you did the full zero write on the drive, that completely wiped out the MBR so there couldn't be a virus still hiding there unless you didn't really do the full zero write, or you did something to get the virus back after wiping the drive.

While it is possible for a virus to infect the system BIOS, it is very rare, and for a BIOS virus to do what you are describing is virtually impossible. I'm making up numbers, but only slightly exaggerating when I say that the symptoms you describe have a 99.99% chance that they are caused either by a corrupted Windows installation (you eliminated that by wiping the drive) or by hardware failure. The other 0.01% is a generous (high) estimate of the likelihood that it is a virus after everything else that you have done.

Thanks for your reply,

Read my procedures carefully and additional the sequence in the steps are exactly as mentioned above.

 

[ajumelet]

First off, whenever you struggle to clean any virus on a OS while booted, if you can pull the drive and connect it to another pc as an additional drive and scan it that way.

Your message is more than likely one of several things, bad hard drive, bad motherboard (ports are failing), bad cdrom drive, or bad media. As some of the guys have already mentioned.

Set your bios to default values.
Connect all your drives including your hard drive.
Download and use either kill disk or dban to wipe the drive. You can zero fill as well with seatools, works just the same. With Dban if it can detect your hard drive, doing a DOD short will provide an even more thorough clear.
Then boot to your XP Disk and let XP setup and format the drive. Just choose quick setup since you'll have done a clear on the drive.
If it fails, try a another CDROM drive first, then new media. If it fails again, I would say you have a bad motherboard. IDE ports are failing.
But just make sure you setup motherboard bios to defaults. Clear the CMOS!!!!!!

Thanks for your reply,

First of all I still working on my computer as usually without the cmos battery, MB and Hardware Components work fine. (also checked out in the option "Hardware device" All mentioned tools are zero-filled based so in comparing with seatools no added value. As decribed I have connected an old clean HDD (clean MBR) with no results. that means that i suspect it is a flashbios rootkit. the only way to check it out is what you say about connecting the HDD into a clean computer and following my procedures as described above. (one drive is sufficient)

 

[ajumelet]

The virus you are describing was likely malware, java related. Most virus programs won't work in those situations. You need to use malware detecting programs like Malwarebytes, Search and Destroy, or Super AntiSpyware.

Thanks for your reply,

Of course i also used antirootkit software,such as GMER, AVAST with no results i am affraid that other anti rootkit give no results also because of its free so software vendors implements features not completely or others
are specialized in some other type of rookits. the scanning methods are also different and does not completely all the whole aspects of the scanning areas.

 

[ajumelet]

So what is the difference between an infected HDD into a clean computer and a
clean HDD into an infected system? it has no effects its only in reverse order.
If a clean HDD (MBR/VBR) is connected to my system (suppose it has a clean bios)then no infected items were found and the WinXP PRO-installation according to the procedure above was succesfull