Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: salvaging a TDL3 infected HDD

10 Feb 2011   #1
Diosoth

Windows 7 Home Premium x64
 
 
salvaging a TDL3 infected HDD

My main 1 TB HDD got infected with TDL3 late last month. It eventually escalated to redirecting google searches, an inability to use Windows Update as well as a few other online services and then finally I was left with a system that would not boot at all, only blue screen. Repeated safe mode reboots and MSE scans removed a few nasty infections but I was still left with an infected PC. Finally giving up I tried the onboard Gateway repair option to erase everything and reinstall Windows. Then I was left with an unbootable PC that would bluescreen before Windows could start and finish setting up.

Antivirus removal options proved too expensive so I ordered the Gateay recovery CDs, only for that to fail. A local shop confirmed it was likely TDL3 so I bought a new HDD and installed fresh. But all I could get was a cheap on-sale drive with less capacity. The local shop said they could purge all data for $10 so I took that choice, but when I plugged it in and booted Windows, Alureon.a tried to run from the E: drive 2nd HDD. MSE stopped the attempted run, I "cleaned" it, shut down and unplugged the 2nd HDD. I've downloaded and ran Hitman Pro(3 times) and Malwarebytes(once normal, once safe mode restart) and neither have found anything so it appears the trojan was stopped before it could infect this copy of Windows, thankfully. I do not need a recurring infection destroying my PC again.

So I am left with a 1 TB HDD that's been shop formatted but still infected. They might try to charge $75 to clean it. Are there any safe, cheap alternatives to do this myself or should I junk the drive totally, forget it and just buy another drive if I want the extra storage? Wich frankly, if I'd known they were not going to clean out the infected boot sector it'd be in the trash now.


My System SpecsSystem Spec
.
10 Feb 2011   #2
oreo27

Windows 7 Ultimate x64 Service Pack 1
 
 

There is a bootable dvd I'm going to recommend to wipe your drive. This way, you won't have to load any OS for the Virus to spread.

DBAN Download | Darik's Boot And Nuke

Quote:
Darik's Boot and Nuke ("DBAN") is a self-contained boot disk that securely wipes the hard disks of most computers. DBAN will automatically and completely delete the contents of any hard disk that it can detect, which makes it an appropriate utility for bulk or emergency data destruction.
I've used this quite a number of times when reformatting. And I can confirm that this low level drive wiping tool works perfectly. Give it a try mate.
My System SpecsSystem Spec
10 Feb 2011   #3
Diosoth

Windows 7 Home Premium x64
 
 

Quote   Quote: Originally Posted by oreo27 View Post
There is a bootable dvd I'm going to recommend to wipe your drive. This way, you won't have to load any OS for the Virus to spread.

DBAN Download | Darik's Boot And Nuke

Quote:
Darik's Boot and Nuke ("DBAN") is a self-contained boot disk that securely wipes the hard disks of most computers. DBAN will automatically and completely delete the contents of any hard disk that it can detect, which makes it an appropriate utility for bulk or emergency data destruction.
I've used this quite a number of times when reformatting. And I can confirm that this low level drive wiping tool works perfectly. Give it a try mate.
Alright, I've downloaded and burned a copy. I'll probably run this later. It also gives me a repair option should I get infected again, which it looks like it did not tonight, but I've become so paranoid over this after dealing with it for almost 2 weeks I'm going to worry anyway.
My System SpecsSystem Spec
.

10 Feb 2011   #4
oreo27

Windows 7 Ultimate x64 Service Pack 1
 
 

Sorry you lost me there mate. What gives a repair option?

Please let us know what happens.
My System SpecsSystem Spec
10 Feb 2011   #5
Diosoth

Windows 7 Home Premium x64
 
 

Quote   Quote: Originally Posted by oreo27 View Post
Sorry you lost me there mate. What gives a repair option?

Please let us know what happens.
Gateway has a repair option as part of the same menu that selects safe mode. It's basically the recovery software on a protected volume of the HDD. Unfortunately, while that can wipe data and reinstall Windows it doesn't clear out TDL3/Alureon or touch the MBR. It's why I had to buy another HDD to start with.

But now that I have DNAB I can hopefully totally purge this drive and should I get another infection I can use it to start fresh again. TDL3 is a very nasty bit of malware to get rid of.

EDIT: oh, you meant in regards to my posted sentence. DNAB would give me a quick way to wipe an infected W7 if I were to get it again. I simply can not afford the $150 or more local shops charge for antivirus services.
My System SpecsSystem Spec
10 Feb 2011   #6
oreo27

Windows 7 Ultimate x64 Service Pack 1
 
 

Quote   Quote: Originally Posted by Diosoth View Post
Quote   Quote: Originally Posted by oreo27 View Post
Sorry you lost me there mate. What gives a repair option?

Please let us know what happens.
Gateway has a repair option as part of the same menu that selects safe mode. It's basically the recovery software on a protected volume of the HDD. Unfortunately, while that can wipe data and reinstall Windows it doesn't clear out TDL3/Alureon or touch the MBR. It's why I had to buy another HDD to start with.

But now that I have DNAB I can hopefully totally purge this drive and should I get another infection I can use it to start fresh again. TDL3 is a very nasty bit of malware to get rid of.

EDIT: oh, you meant in regards to my posted sentence. DNAB would give me a quick way to wipe an infected W7 if I were to get it again. I simply can not afford the $150 or more local shops charge for antivirus services.

Oh okay. Yup, I used it loads of times. It comes with several options on what method to use when wiping. But I do have to say that wiping a drive takes time. Using the "Quick Erase" option takes about an hour and a half on my 500GB disk.

Indeed! They charge loads of cash that free software and https://www.sevenforums.com/ can fix.
My System SpecsSystem Spec
10 Feb 2011   #7
Ciara

Windows 7 Professional 64-bit SP1
 
 

Darik's Boot and Nuke ("DBAN") works very well, I used it on my old laptop that I gave away.
My System SpecsSystem Spec
10 Feb 2011   #8
Golden
Microsoft MVP

Windows 7 Ult. x64
 
 

Hi,

As a backup option, you can also try this Rootkit remover by Kaspersky - free.

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Regards,
Golden
My System SpecsSystem Spec
10 Feb 2011   #9
CanIHaz

Windows 7 Home Premium x64 SP1
 
 

You can try Hitman Pro. Its very good at detecting and removing rootkit. Upon removal, it will replace the infected file with a new one.
My System SpecsSystem Spec
Reply

 salvaging a TDL3 infected HDD




Thread Tools




Similar help and support threads
Thread Forum
Salvaging An HP Windows 7 Computer
The office of a coworker's wife was getting rid of their old computers and I picked up an HP dual core desktop running Windows 7 for $25. I would like to salvage this PC for my own use. What I would like to do is to somehow create a Windows & CD/DVD, do a clean install of Linux MINT 14 to...
Installation & Setup
TDL3 Rootkit 64 Bit Driver
KernelMode.info • View topic - Rootkit TDL 3 (alias TDSS, Alureon)
System Security
x64 TDL3 rootkit - follow up.
Source - x64 TDL3 rootkit - follow up
News
TDL3 rootkit x64 goes in the wild
More - TDL3 rootkit x64 goes in the wild
News
Salvaging Email addresses from old PC (XP)
After browsing the Email section of the Windows 7 Forum it looks like my Email Address Book will not just transfer into Windows 7 from my old XP PC. The majority of my info from my old PC (XP) was transferred into my new Windows 7 PC but the guys at the shop just hung their heads when I said I...
Browsers & Mail


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 05:57.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App