Windows 7 UAC disables itself Read for more.

Snagg57 said:

Hello.

I need your help, i am running Windows 7 RC Build 7100.

and my UAC keeps disabling it self. Now i recently got a Virus names msa.exe which i removed Via MBAM and double checked the Regrestry keys and found nothing related to that. I also scanned my E drive (Windows 7 C Drive) with AVG using Slow scan and found nothing harmful.

Help please.

I honestly doubt it is a Hardware related problem.

Click to expand...

Snagg57 said:

kk MSE said something about a Trojan which i cannot find.

Alureon.A Was the thing i found.

Click to expand...

• Win32/Olmarik!generic (CA)
• Rootkit.Win32.TDSS.u (Kaspersky)
• W32/TDSS.drv.gen4.A (Norman)
• Mal/TDSSPack-V (Sophos)

Jacee said:

Information about Alureon.A
Encyclopedia entry: Virus:Win32/Alureon.A - Learn more about malware - Microsoft Malware Protection Center

Aliases

• Win32/Olmarik!generic (CA)
• Rootkit.Win32.TDSS.u (Kaspersky)
• W32/TDSS.drv.gen4.A (Norman)
• Mal/TDSSPack-V (Sophos)

TDSS is a Rootkit

msa.exe

Antivirus - MSA.exe - Program Information

Click to expand...

Snagg57 said:

Found the culprit.

Atapi.sys in Windows System32 folder.

Some one upload Atapi.sys for me so i can replace?


And MSE didn't work it daid it killed it but it came back >.>

Click to expand...

http://www.wilderssecurity.com/showpost.php?p=1617595&postcount=918 said:

This build is all about removing the latest TDL3.24 rootkit that is spreading like fire! In the last weeks we cured over 13.000+ computers. Most of these computers were having an up-date AV installed that should have prevented infection.

If you search in the last week for 'google redirect virus' you'll see how big this is.

If you are browsing the internet and you are directed to different sites than expected, your PC is probably infected with this highly advanced and evolving rootkit.

Hitman Pro 3.5.4 build 87 can cure all current variants, up to version 3.24.

Click to expand...

http://www.drweb.com/static/BackDoor.Tdss.565_(aka%20TDL3)_en.pdf said:

Now the installation continues in the kernel mode. The rootkit searches through the
stack of devices responsible for interaction with the system disk to determine the driver it is going to infect, its future victim. The choice depends on the hardware configuration. If the system disk uses the IDE interface, it will pick out atapi.sys, in other cases it can be iastor.sys. There are rootkits that infect file system and network drivers or even the system kernel to ensure their automatic launch (BackDoor.Bulknet.415(Virus.Win32.Protector.a/W32/Cutwail.a!rootkit), Win32.Ntldrbot (Virus.Win32.Rustock.a/Backdoor:WinNT/Rustock.D), Trojan.Spambot.2436 (Trojan-Dropper.Win32.Agent.bwg/TR/Drop.Agent.BWG.1) and others) and this instance is not an exception.....

Click to expand...

Snagg57 said:

kk MSE said something about a Trojan which i cannot find.

Alureon.A Was the thing i found.

Click to expand...