Solved Stuck on verifying DMI Pool after TDSS removal, can't repair OS

[bigblocktowncar]

I am using 64bit Pro. Core i7 920 12gb RAM, an eVGA X58 mobo

I had the TDSS/Alureon malware on my pc. It was redirecting most google traffic, playing background ads that could not be seen in task manager or closed in any way.

I downloaded some of the TDSSkiller etc files which did not seem to help. Upon a restart after running the TDSSkiller file, I reenabled Windows Security Essentials. It detected Alureon.K by name and I removed it.

Upon the next restart, the system will not boot past the verifying DMI pool data screen. I have let it sit for about 5 minutes, so at this point I don't think anything is going to happen. I tried using the repair with my Windows 7 DVD, but it does not detect an operating system and cannot do the repair. I have also tried this several times. I have three HDDs, I unplugged the two non-OS drivers and the same thing happened...no OS is found. I cannot boot into safe mode as the boot sequence does not get that far.

I am wondering if Windows Security Essentials deleted a boot file of some sort.

What is the next step?

Thanks

 

[Layback Bear]

Well you infection is a rootkit, a very bad one. You can try this first.
http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html
Their is a good chance you will have to do a disk clean wipe and clean install of Windows 7.

 

[Golden]

Hi,

Its extremely rare now for anyone to attempt to 'fix' rootkit infections - almost all anti-malware software can't keep pace with the speed at which rootkit variants are appearing. They are also getting notoriously difficult to completely remove.

Your best bet is to wipe the disk, and do a fresh installation:

For wiping hard disk:
http://www.sevenforums.com/tutorials/172617-secure-erase-wipe-definition-methods.html

For retail Windows 7 installation:
http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

For OEM (pre-installed) Windows 7 installation:
http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

Regards,
Golden

 

[bigblocktowncar]

meh.

I was hoping to be able to save this installation. I am getting a SSD in the next week or so and didn't want to do two fresh installs.

Back up and running now. I'm not going to update or reinstall any software until my SSD arrives. Do you have any articles on using Win7 and SSDs? BIOS settings? I seem to recall seeing something about turning off the page file and SMART disk feature.

 

[Golden]

Hi,

Do the HDD install now, then use Macrium to image it, then restore the image to the SSD when it arrives and you have installed it, or use the transfer method in tutorial below.

http://www.sevenforums.com/tutorials/73828-imaging-free-macrium.html
http://www.sevenforums.com/tutorials/149969-ssd-install-transfer-operating-system.html

For the SSD, use the AHCI mode in the BIOS. Apart from that, I wouldn't tamper with pagefile etc. This will help.

http://www.sevenforums.com/tutorials/91339-ssd-hdd-optimize-windows-reinstallation.html
http://www.sevenforums.com/tutorials/70822-ssd-tweaks-optimizations-windows-7-a.html

Regards,
Golden

 

[Layback Bear]

What kind of SSD are you getting?

 

[bigblocktowncar]

Intel 520 or Samsung 830 most likely. The Samsung 830 128gb are on sale at Newegg until midnight for $90 with the email promo code. Intel drives are about 120 for the same size but have a 5 year warranty vs the Samsung 3 year warranty.

Intel drives seem to be about $1 per gb up to a certain size, then the price increases.

 

[bigblocktowncar]

Can I use the ACHI mode in the BIOS before installing Windows 7 onto the new SSD? Or is it done afterwards?

 

[Golden]

Can I use the ACHI mode in the BIOS before installing Windows 7 onto the new SSD? Or is it done afterwards?

It can be done before.

 

[Layback Bear]

I would be very careful of what you transfer from old drive to new drive. You could transfer the infection and that makes a very bad day.

 

[bigblocktowncar]

I never take an image of my harddrive. I keep all music and stuff on a separate drive that has nothing else on it. The only thing I take off the "C:" drive is usually my documents and pictures. Hopefully there is nothing in there.

 

[Layback Bear]

Documents and Pictures many times are infected. I wish you luck.