Virus remains after formatting

[fralo]

Hi all,

Upon running MalwareBytes it reports that I have "Trojan.DNSChanger". The log says quarantined successfully and then requires reboot. Next time I run it, though, and it's still there.

So I decided to reformat and reinstall OS. I'm never had to do this before but am certain I did it correctly, having watched a youtube tutorial. I booted from my CD, highlighted the partition, clicked "delete". It then says 'unallocated space' as expected. I proceed with the install. But upon completion, the trojan remains!

In normal mode, I keep getting repetitious messages appearing on the taskbar saying something like 'malwarebytes: stopped outgoing message (svchost.exe).

I'm quite the novice, so any help you could provide is greatly appreciated.

Thank you.

 

[DustSailor]

Try this out for a reinstall: http://www.sevenforums.com/tutorials/91339-ssd-hdd-optimize-windows-reinstallation.html

Whenever it says to "clean all", do it, not just a "clean", as in:

Now type clean all <enter> you will get a blinking cursor telling you that clean all is working like in the second snip down, just relax and let it work.
NOTE: You could type clean instead to do the same thing quicker, but just without a secure erase.

Let me know how it goes.

Tutorial Credit:
Bare Foot Kid

 

[dwarfer66]

What are you reinstalling after the Win install?

 

[DustSailor]

What are you reinstalling after the Win install?

Dwarfer makes a good point, make sure you aren't downloading anything until you have an antivirus installed

 

[karlsnooks]

fralo,
After carrying out the instructions given by Dust Sailor then:

1. Install immediately MSE (Microsoft Security Essentials). Use the link in my signature.

2. Fully and completely update your Win 7.

3. Make a system image backup using Windows Backup and Restore to an external USB drive. This is so that you can reinstall a known good system in case you immediately reinfect yourself which shouldn't happen if you have carried out Step 1.

Here is the link to the tutorial for a system image backup:http://www.sevenforums.com/tutorials/663-backup-complete-computer-create-image-backup.html

 

[fralo]

Okay, I followed the instructions to no avail. But here's what I did step by step.

1) Booted from WINDOWS 7 CD.
2) At language screen, hit shift/f10 to go cmd prompt
3) diskpart
4) list disk
5) select disk 0
6) clean all
7) exit
8) exit

Now back at the install screen, I made it to the listing of partitions. Selected disk 0 (unallocated space).

After install, trojan remains.

It also affects the screen when booting up. There are different colors, checked background. Before it actually gets to the Starting Windows logo, there are a bunch of "aa" scattered across the screen.

Thank you all for your help thus far. I may have to just get a new hard drive.

 

[karlsnooks]

and where did you get this windows 7 "cd"?

 

[karlsnooks]

Incidentally,
I guarantee you that if you performed a CLEAN ALL, then no virus survived.

This means you infected the system after the clean all.

The clean all writes zeroes to each and every byte on your hard disk.

 

[CB]

Hi Fralo.

Just another question. Do you have multiple partition? (C:, D:. E:, etc)
If yes, then it most likely the viruses or malwares reside in any drives other than C: drive.
As we always aware, when windows done installing, it then initially search for any other drives, read it, and lettering it. But it also will read a folder named "System Volume Information" on each drive. The problem is most of recent viruses and malwares reside inside those system protected folders and manipulate windows to read and execute them.

My suggestion is before reinstalling windows try to delete any files or folder inside "System Volume Information" on each drive. It sometime can be reached using bootable linux system.

Hope that helps a little.

Kevin

Edit: You have to know the folder also has some saved automatic or manual system restore data. When deleted, it will loss. But with newly installed windows, you might not need it anyway.

 

[karlsnooks]

kevin,
Clean ALL will take care of that if they are all on the same physical drive.

If he has multiple physical hard drives, then the other drives should be physically removed.
After Win 7 is installed, then running WDO over all hard drives will be a necessity.

 

[DustSailor]

fralo, if you have the license on the computer case, you might try to download/install the ISO (the same version as you have for the license) here: Official Windows 7 SP1 ISO from Digital River « My Digital Life

You will need another computer with DVD write capabilities. Use this program to create a CD from the ISO you download: Microsoft Store Online

You can also use a USB stick, but I've come across complications doing it. It may work for you as I imagine my situation was unique: http://www.sevenforums.com/tutorials/31541-windows-7-usb-dvd-download-tool.html - created by Darryl Licht

Also, as Karl above said, remove all other drives EXCEPT the C drive which you are installing the system to. The CD/dvd player should be the only other 'drive' connected. This includes all USB sticks. If you use a USB stick to install windows from, make sure it is FREE of viruses first.

 

[karlsnooks]

DustSailor,
I agree with your advise which is part of my motivation in asking where he got his Win 7. Possible is that the DVD is infected.

My experience has been that most people with USB problems actually have defective USBs. Sometimes by using clean all on the usb, then creating a partition, formatting the partition as NTFS, setting active then one can use the usb.

 

[metalmania31]

OP, you don't have any other type of storage on the system during install do you? i.e. USB stick, other hdd's, any media in cd/dvd drive.
What about the possiblity of a bios infection?

 

[CB]

Thanks, Karl.
Haven't noticed that.

Then the only suspect is probably the installation CD/DVD, or any other that follows? That a bit weird though?

Edit:
Late posted, connection problem

 

[DustSailor]

DustSailor,
I agree with your advise which is part of my motivation in asking where he got his Win 7. Possible is that the DVD is infected.

Yes, mate. I too would question the CD. I skipped that part because you had already asked the question, so I just posted the bit on the ISO. Now we'll wait for the OP to respond to see the origins of this CD, or if it is possible the virus resides on a USB stick/other drive that has yet to be removed.

My experience has been that most people with USB problems actually have defective USBs. Sometimes by using clean all on the usb, then creating a partition, formatting the partition as NTFS, setting active then one can use the usb.

Quite possible, though I had to do a sort of backwards install (upgrade version install in a business). The fault most likely rest with the upgrade ISO I was trying to boot from, instead of a full install (which I ended up using). The entire story is probably reserved for another time, however, and not on this thread. I don't want to go too far off topic, I have that problem

 

[F5ing]

Okay, I followed the instructions to no avail. But here's what I did step by step.

1) Booted from WINDOWS 7 CD.
2) At language screen, hit shift/f10 to go cmd prompt
3) diskpart
4) list disk
5) select disk 0
6) clean all
7) exit
8) exit

Now back at the install screen, I made it to the listing of partitions. Selected disk 0 (unallocated space).

After install, trojan remains.

If that 'clean all' completed without errors that disk should be clean (it took quite a while to complete, right?). The trojan must be coming from elsewhere.

It also affects the screen when booting up. There are different colors, checked background. Before it actually gets to the Starting Windows logo, there are a bunch of "aa" scattered across the screen.

Thank you all for your help thus far. I may have to just get a new hard drive.

I don't think you need a new hard drive.

As metalmania31 mentioned previously, you might investigate the possibility of a bios infection (very rare but possible), especially as you've noticed oddities in your pre-Windows boot screens. Can you get into the BIOS? If so, does it look the same as it always did?

When you say the trojan remains after reinstall, is it the same "Trojan.DNSChanger"? Is it another MalwareBytes run that identifies it?

And as others have mentioned you should suspect your other storage drives and install media.

 

[OldMX]

Lol, you dont have a bios infection, get real, if the virus survived a clean all disk command, then you have the infection somewhere, like where you store your personal stuff or downloads, time to check external disks, usb jumpdrives, etc.

 

[karlsnooks]

Lol, you dont have a bios infection, get real, if the virus survived a clean all disk command, then you have the infection somewhere, like where you store your personal stuff or downloads, time to check external disks, usb jumpdrives, etc.

Please read our tutorial on using the CLEAN ALL command.

You will see that no malware will survive.

I also rule out a virus infection, however, CLEAN ALL does not touch the bios.

True is that one must also use an offline malware removal program such as WDO, link in my signature, to make sure that UFDs and external disks are malware-free.

 

[karlsnooks]

Fralo,
I noticed you never answered the question as to the source of your WIN 7. I can only assume then that the Win 7 is not from a legal source.

This tutorial will show you how to install and give you a link to a legal source to download a Win 7 ISO.
http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html#post1839164

 

[windude99]

Try running Darik's Boot and Nuke to wipe the hard drive: http://www.sevenforums.com/tutorials/233819-dariks-boot-nuke-use-secure-wipe-hard-drive.html