redirecting me to other websites

waddler_8

Did you download & save the file gparted-live-0.11.0-7.iso to your computer?

waddler_8

closed wrote: »

http://free.antivirus.com/rescue-disk/

http://support.kaspersky.com/faq/?qid=208282173

Are you sure the rescue disk can fix this?

aliEnRIK

waddler_8 wrote: »

Then it could be the infection stopping it. That points to the new variant of the TDL4 bootkit.

Dont take this the wrong way, its good that your helping the OP and others. Im just curious as to how youve jumped to the conclusion the problem is the TDL4 bootkit?

waddler_8

debitcardmayhem wrote: »

I don't know what waddler had in mind for F8 so I won't speculate.

...Using the command prompt from the RE to restore the MBR using MBRfix (it can be run via the RE). The USB flash drive is for a tool that can also be run via the RE from a flash drive.

The partition table shows 4 partitions - I'm presuming; 1. Recovery (hidden), 2. The OS partition, 3. A backup/data partition & of course 4. The rootkit's partition (hidden).

The boot flag has to be set correctly, so I have to know exactly which partition the OS is on - I can't just presume the above - I need to know for sure.

waddler_8

aliEnRIK wrote: »

Dont take this the wrong way, its good that your helping the OP and others. Im just curious as to how youve jumped to the conclusion the problem is the TDL4 bootkit?

From the symptoms + I've got a copy of the MBR that the OP emailed me - Examining that you can see the rootkits partition and that it's set as the active partition.

closed

Can't guarantee it.

Haven't read the whole thread, but if it is what you suspect, disk administrator is an easier way to change active partitions, assuming it isn't blocked by the infection - suggest the op posts a disk administrator screen shot before going down the gparted route.

aliEnRIK

Makes sense now.
Although it would be nice if information was shared on the thread because how would anyone else know?

waddler_8

closed wrote: »

but if it is what you suspect, disk administrator is an easier way to change active partitions, assuming it isn't blocked by the infection

I do know that it cant be done through DM with the infection active.

waddler_8

aliEnRIK wrote: »

Makes sense now.
Although it would be nice if information was shared on the thread because how would anyone else know?

I did post it earlier somewhere (I think...)

closed

surprised it got past kaspersky.