virus/spyware/trojan or malware - unknown name

It's been scanning now for over 30 Mins - shall i leave it still?

Leave it a bit longer, if still no luck, boot to safe mode and try it from there.

When trying to boot in Safe mode i get a blue screen saying unable to boot in safe mode etc.

It gives this technical information:

Stop: 0x0000007E ()XC0000005, 0X8050FBDB, 0XF789E4CC, 0XF789E1C8)

When i try again it says boot in XP or recovery which one should i choose?

XP normal.

No keeps coming up witgh the same blue screen

Tried it several times in Normal mode and keeps coming up with the blue screen again.

Hmm, are you able to boot to safe mode?
Try running Combofix in safe mode.

No i cant seem to boot into Safe Mode without encounting the blue screen.

Then i have to power off by the PC button and when restarting it displays the screen informing me of a system problem and to select which mode to restart in again. I then select XP professional rather than system recovery.

You mean the recovery console? I wonder if we can use that to restore atapi.sys

Are you on another machine right now? cause were gonna need to have the infected machine running so we can restore it.

Yes sorry I mean the recovery console.

I am using another machine, so we can restore it.

Okay, boot into the recovery console.

When you get to the command prompt, type in:

cd C:\Windows\system32\drivers

Hit enter. It will go into the drivers folder. Next type in dir and hit enter.

That will list every file in the drivers folder. Look somewhere near the top for atapi.sys. If the file is there, it will show file size next to it.

What's it's filesize right now? 95,360 or 95,872? or does the file not exist/show at all?

I have come up with the following black screen and a prompt as follows;

Which Windows Installation would you like to log onto, to cancel press ENTER>?

It seems to only allow one character option space entry before hitting enter?

Also do i type the CD part of cd C:\Windows\system32\drivers?

Last edited by darrylrixon on 18th December 2009, 12:52 pm; edited 1 time in total (Reason for editing : added question)

And it leads to the BSOD if you press enter? hmm, weird.
Does this machine have an OEM partition? if so, we can restore the machine back to factory settings.

How can i tell if it has a OEM partition? as i'm not sure.

Can't remember which option menu it is, but when booting up, tap F10 OR F12, one of the 2 menus might have a "restore to factory settings"

Okay, F12 gives the follow options;

Onboard Sata hard drive
Onboard or USB CD-ROM drive

*System Setup
*Hard Drive Diagnostics
*boot Utility Partition

Shall i go for boot utility partition?

No. Our last option is a boot disc.

Please download this file: Avira Rescue Disc

1. Insert a black CD into your CD draw.
   
2. Double click the rescuecd.exe file on your Desktop.
   
3. Hit the "Burn CD" button and allow it to burn, it shouldn't take too long.
   
4. Next, reboot your computer, keep the CD inside the draw.
   
5. Your computer should boot from the CD and boot to the Avira rescue disc.
   
6. Next, see this guide here and follow the instructions on that page: How to use the boot disc
   

Let me know how it goes.

It done lots of searches and renamed one file and found 10 possible alerts, have rebooted in XP and its still the same.

What is the final way around this put the hard drive in for repair, wipe it and start again?

If its wiped/formated will that definately remove any/all of the viruses?

thanks

Yes it would.

Okay, thanks for you assistance - i'll have to go down this route after all.