phantomphantom

Fantastic I'll give that go once I've got a drive - thanks for all your help! Really appreciate it. :) You've all been really helpful and prompt (and patient with a newbie) Will defo be dontating once I'm on a clean computer! Cheers, Jim

Ok kool. That's a bit better than having to install windows and all my programs again. :) I just need to buy a large external drive so I can copy all my data across. Is there any risk /or how can I stop any virus being copied across to the external drive? I read you can stop windows autorunning it or something? Even if it's not running from windows from that drive does the sinowal trojan still work/continue to be active?

I had a problem last year when I tried to update my windows/install 4OD (channel 4 s/w) and it completely crashed and wouldn't boot up. So i bought a new hard drive and did a clean install of windows on there. Which is now C: I've just left a message with my brother as he helped sort it - I have a vague memory that windows was on this E: drive originally. And it was deleted afterwards. I'm checking if that was the case thou. Is there a simple way to check? E: is where the majority of all my data is stored

I have two drives C: and E: Windows XP is installed on C:

Just wondered if there is anything else to try - as I write music for living so have loads of music progs on my system and it takes to ages to install them tweak them for my system.

Hi, The Avira isn't that descriptive and I've checked the quarantine and it hasn't moved it to there. Avira Report: Starting master boot sector scan: Master boot sector HD0 [iNFO] No virus was found! Master boot sector HD1 [DETECTION] Contains code of the BOO/Sinowal.A boot sector virus [NOTE] The boot sector was not written! I ran that bootrepair tool again and it just says: Virus: The MBR contains a signature of the virus 'Boo/Sinowal.A' Is there another way to check exactly where it is? >Be informed though that you will lose all your previous restore points. What will I lose if this method is followed? I've now got my windows cd to hand btw Thanks for your continued help with this one :)

I haven't got it here - so I'd have to continue tomorrow... What's the next kind of steps?

It ran a few lines - that said it had found the virus, deleted 0 files and then just went back to the command prompt. The only option it gave me was right at the beginning to choose english or german lang

Ok - I see where I was going wrong - I had burnt the cd as data rather than an image (1st time I've done that - I realise what an iso is now....) It ran - and detected the boo.sinowal.A but didn't repair it or delete it. ?

interesting vid and writings on the sinowal virus: YouTube - Warning Serious Internet Explorer Torpig Mebroot Sinowal Virus / Phishing scam

If I double click on that Iso file it opens up similar to a .rar or .zip file. In it is a folder called CVS and once that folder is open it contains the following files: Template (size 0) Root (size 55k) Repository (size 47k) Entries.Old (size 0) Entries.Extra.Old (size 0) Entries.Extra (size 65) Entries (size 140) Do you think its a case of extracting these files and putting them on another cd and giving that a go?

Hi Wolfeymole, Yes I checked again that the Bios was set to boot to cd drive first and it was... Again it booted up fine from cd straight through to windows. Should it have written a new boot sector or something?

Update - i saved the iso and burnt it as test.iso to a cd (does it matter what it's called as it didn't supply a default?) Turned off computer with cd in and let it boot. It was definitely accessing the cd on bootup and it went straight through to windows fine. Did a scan with Avira and it found the Boo Sinowal again on Masterboot sector HD1 Was I doing something wrong? Or is there anything else to try? Thanks for ya continued help. Appreciate it. Jim

Ah right - I think that makes sense. :) So I exit the program - it asks me if I want to save the ISO. I save it somewhere on my h/d. I then burn that ISO file to a cd. Then I insert that cd once Avira Boot Sector Repair Tool starts up. Is that correct?

Nero (for my sins) ;-)

Yep - that's the one. It just asks you to select the burning device.

It doesn't specfically say... Is it worth trying the windows cd?

Just doing a google and it seems a few people have cleared up Boo using Dr.Web Cure It. is Dr.Web Cure It safe to use? Or effective?

- Boo Sinowal I finished the scan with Avira and it recommended their Antivir Boot Sector Repair Tool or the Antivir Rescue System to fix it. Downloaded both and tried both. It runs to the point of asking for cd. I've put in several blank cds - the cd spins for a little bit and then windows locks up. Tried this several times but no progress. Is there another way or another program to remove Boo Sinowal? Thanks, Jim

Right - went through the steps last night. It wouldn't allow me to run some of the programs at first until I renamed them. At step 3 it found 246 files infected (mainly adware) and 80 in the registry (a harsh lesson in not having any spyware software installed.) At step 4 it found 10 objects At step 5 it found 1 file and deleted it. After that I installed Avira AntiVir and removed AVG. Set up Comodo as my firewall. System seemed to run a treat after that. MASSIVE THANKS beeceebee! Great advice - given really promptly. My windows booted up ok and no annoying browser issues. :) Couple of questions. 1) I started my Avira to do a scan this morning and it found Boo/Sinowal. A boot sector virus. I had to pause it before it was 100% and shut it as I had to leave for work. Is Boo a problem and is there anything I can check this eve to definitely make sure any trojans etc are gone? 2) Also I have a router connected to my computer for wireless for 2 other people in my house. Could anything have been passed over to them via wireless? Housemate had done scan the other day with Norton and found nothing. Btw your link to ATF-cleaner to snapfiles.com is outdated. This was definitely a lesson in not having proper spyware & firewall software installed. Will defo be making a donation as your advice was spot on! :) Jim

Smart - thanks for the prompt replies. Loving this website already! :)

Excellent - thanks for that. I've follow ur instructions this eve and report back. >internet firewall security What free firewall s/w do you recommend? Also someone suggested Avira Antivirus as a better alternative to AVG - what do you think? Thanks, Jim

Hi, Could someone give me a hand removing the backdoor.tdss.aru trojan? I noticed google had started redirecting me to other website so downloaded and ran spyware terminator (I've only got AVG antivirus installed) and it found the following: 180searchassistant windows\system32\TDSSoiqh.dll It removed 180searchassistant but not the TDSSoiqh.dll I downloaded malware bytes anti - malware but it wouldn't let me run the installer - I've read you can rename the .exe to either .bat .com or .scr - haven’t done this yet - as I just wanted to check what's the best way to remove this trojan. I'm in work at the mo - so on a clean computer and have changed all my passwords and spoke to my bank/credit card people - just in case. What's the best course of action? Thanks in advance, Jim