Quote:


If your imaging software makes a true disk image, I see it as the easy way to get rid of the malware.






and so it proved, Notes.

To cut a long story, well, long, I realised that I had to take some action to get rid of the virus.

Kaspersky’s site indicated clearly that the rescue disk is designed for use when all else had failed and they recommend trying one of their products, Kaspersky Virus Removal Tool (KVRT) first.

I did this and sure enough KVRT found 3 instances of a mem:win32Rootkittdss.a virus – all hiding away in various systems files.
The first instance the tool proposed only ‘Skip’ (‘disinfect’ and ‘delete’ not being available). The second time KVRT was able to disinfect and the machine rebooted smoothly. The third time, KVRT disinfected but I was left with a machine which cycled to shut off and BIOS, i.e. no version of Windows would launch.

I guess, in clearing out the malware, KVRT had made some sort of change to an essential windows file.

At that point (it was around 1 am) I reckoned I had nothing to lose by trying the Macrium Disk image backup. This took 40 hours to install (that can’t be right!) but, as it says on the tin, has taken my system back to the moment the image was made.

I have since updated Windows and my AV/protection tools and I appear to be back in business. The symptoms described at the beginning of this thread are no longer visible.

Thanks to one and all for your help and advice.

Moral of the story: make an image backup now!!

Marc

Marc's SoundCloud
Marc's YouTube