Totally lost - win32/olmarik.ajl trojan

I'm sorry if I posted this in the wrong forum,
but this one seemed most appropriate to post this...

I wouldn't usually go to forums to ask a virus-related problem,
but I have NO CLUE what to do anymore,

Everytime my PC boots NOD32 gives me a message that there's a olmarik.ajl trojan in my MBR of Phsyical Drive 1 (Which is my C: drive)

I've tried some things,

Scanned with NOD32 & SPYBOT,
but since it's in MBR that didn't help,
I did a MBR Fix by dooing bootrec /fixmbr in win recovery.

When that didn't work I flashed my bios,
in case it was hiding in there, which is probably isn't, but not tried is.. you know.

After that STILL not working, I just formatted my C drive since it was supposed to be there (I have all my other things in different partitions, cuz' I expected something like this to happen eventually)

and after that I still got the same error for the same drive, and I repeated all again except the format.

So please,
anyone has any idea what to do?

Hello there, i've read that using Dr. Web Cure It will take care of that virus (although you have to run it in Safe Mode, by pressing F8 on BIOS screen), i'd put the link here but it's a Latin American article, so it's in spanish.

Here's the link for Dr. Web CureIt:

http://www.freedrweb.com/download+cureit/gr/?lng=en

Install it, reboot into Safe Mode with Networking, and do a Full Scan with it

Report back after the scan with the results, please.

Here's another article about this:

Win32/Olmarik.AJL Trojan - Safer-Networking Forums

Apparently is not a simple and easy to kill virus

Thanks a LOT Punisher, that solved that issue.
Now another issue is that my ping is still 512ms instead of my usual 16,
any tips on that?

That could be a simple issue from your ISP. i don't think the virus has something to do with your 512ms ping :huh:

My laptop still has ~15 ping,
and it started to go up to 512ms ping after I got the message of the virus =X

Well, you could try to do a Winsock Reset. But i'm not sure if that could fix the problem.

I created a Batch File for you, if you don't feel safe about it.

Here is its content:

ipconfig /release

pause

ipconfig /flushdns

pause

ipconfig /renew

pause

netsh winsock reset catalog

pause

netsh int ip reset reset.log hit

pause

Click to expand...

That will Repair your winsock entries and could help with the problem

EDIT: Download the file, go to the path where the file was downloaded, right click it, go to properties and click "Unblock" on the bottom. Apply and accept, then right click it again and "Run as Administrator"

olmarik.ajl trojan is not that easy to get rid of. It is a "Backdoor Trojan" with a rootkit.

My advice would be to wipe and do a clean install. Stay away from cracks and keygens

Jacee said:

olmarik.ajl trojan is not that easy to get rid of. It is a "Backdoor Trojan" with a rootkit.

My advice would be to wipe and do a clean install. Stay away from cracks and keygens

Click to expand...

That's what i though Jacee, but i didn't want to suggest that because it'd be like the "last resort" but yeah, i read that olmarik.ajl trojan wasn't an easy virus..

BTW, i've never heard that virus before, how could you get infected by it? :huh:

Many ways to get infected!

1. Using a peer-to-peer (P2P) application that allows its users to join together in a network via the Internet and share files from each other's hard drives.
2. Using an infected flash drive
3. Clicking on unknown links
4. Downloadung cracks and keygens

Ohh didn't know that hehe.. that's exactly why i have "autoruns" disabled, a good antivirus (NOD32, good for my taste ), Malwarebytes' and a LOT of common sense that hasn't failed me since a really long time..

I'll be aware and also tell my little sister not to mess with unknown links

Thanks, Jacee

It probably wouldn't hurt to take advantage of Firefox's plug in (if you run FF) called NoScript. It stops embedded scripts on a page (unless you allow them)

Winner of the "2006 PC World World Class Award", this tool provides extra protection to your Firefox.
It allows JavaScript, Java and other executable content to run only from trusted domains of your choice, e.g. your home-banking web site, guarding your "trust boundaries" against cross-site scripting attacks (XSS), cross-zone DNS rebinding / CSRF attacks (router hacking), and Clickjacking attempts, thanks to its unique ClearClick technology. It also implements the DoNotTrack tracking opt-out proposal by default, see http://snipurl.com/nsdntrack .
Such a preemptive approach prevents exploitation of security vulnerabilities (known and even unknown!) with no loss of functionality...
Experts do agree: Firefox is really safer with NoScript

Click to expand...

Read more here:

https://addons.mozilla.org/en-US/firefox/addon/noscript/

Script Defender works with IE and Windows 7 System Downloads : Script Defender /// AnalogX

Thank you Jacee...I knew IE had one, just couldn't remember....gettin old I guess:sarc: