topic Re: Cannot boot computer after running Norton Power Eraser in Norton 360

Need help getting computer to boot after using Power Eraser

B_chicago — Mon, 05 Mar 2012 03:11:00 GMT

Can someone help me with getting my computer to boot after using Norton Power Eraser? I'm running Windows 7. Power Eraser removed one *.dll file and now I can't reboot in safe mode, status repair does not work and system restores to prior points do not work.

[edit: Clarified subject.]

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 03:12:07 GMT

What was being Detected by Norton that had you use NPE, what was the name of the .dll.

Are you using Win 7 32bit or 64 bit??

Quads

Re: Cannot boot computer after running Norton Power Eraser

B_chicago — Sun, 04 Mar 2012 03:19:36 GMT

I don't remember the name of the file removed...something along the lines of djb******.dll.
I'm not 100% sure, but I thought the cpu in question was Windows 7 64-bit...I really should know this, sorry.

At this point, I don't think I should have ran the NPE, because there is nothing particular that was being detected by Norton. I just kept getting these boot.pihar files removed from nortons auto-protection. I frequently use Malwarebytes Anti-Malware and should have just stuck with that.

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 04:09:31 GMT

Can't boot in Safe Mode, I gather you can't boot in Normal Mode either.

This can involve using the Command Prompt offline, logging, scripting etc.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive. hxxp://download.bleepingcomputer.com/farbar/FRST64.exe (replace the hxxp with http

Plug the flashdrive into the infected PC.

Enter System Recovery Options.
To enter System Recovery Options from the Advanced Boot Options:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Choose your language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:
Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Choose your language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.
On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

Select Command Prompt
In the command window type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the Flash Drive.

attach the FRST.txt back here.

Quads

Re: Cannot boot computer after running Norton Power Eraser

B_chicago — Sun, 04 Mar 2012 04:09:43 GMT

Thank you, here it is.

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 04:39:41 GMT

I it take me a tiny bit of time to create the scripts, as I double check my own work.

Attached now,

Download the fixlist.txt

Save it in the Flash Drive, next to FRST.exe

Run FRST as you did before, except that this time around, click on the Fix button and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

To others:-

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Quads

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 04:47:05 GMT

Post above updated.

Quads

Re: Cannot boot computer after running Norton Power Eraser

B_chicago — Sun, 04 Mar 2012 04:49:01 GMT

Done, here is the fixlog.

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 05:08:33 GMT

Same as before but with this attachment below.

Quads

Re: Cannot boot computer after running Norton Power Eraser

B_chicago — Sun, 04 Mar 2012 05:23:07 GMT

new fixlog attached

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 05:26:48 GMT

The Bootkit code is now gone.

can you now boot into windows normally??

Quads

Re: Cannot boot computer after running Norton Power Eraser

B_chicago — Sun, 04 Mar 2012 05:33:26 GMT

Yes, I can. I don't think I was ever so happy to see the Windows logo. Your help was immense, thank you so much!

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 05:35:18 GMT

Hang Fire, we have to do some checks, now we have got back in. OK

Quads

Re: Cannot boot computer after running Norton Power Eraser

B_chicago — Sun, 04 Mar 2012 05:36:23 GMT

ok, i'll standby.

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 05:47:59 GMT

Download TDSSkiller from http://support.kaspersky.com/faq/?qid=208280684

Click on the TDSSkiller.exe link on that site to download and run, In the change paramaters select Detect TDLFS file system, click OK and scan.

Don't have it fix anything, just see if it detects anything.

Quads

Re: Cannot boot computer after running Norton Power Eraser

B_chicago — Sun, 04 Mar 2012 05:55:50 GMT

It appears to have found one suspicious object, medium risk.
physical drive:\Device\Harddisk0\DR0

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 06:14:49 GMT

suspicious object leave it be as you may be using an OEM MBR, when a program like this says suspicious just leave it is safer.

It's also Ok if the detection is actually this TDSS File system, Physical drive: \Device\Harddisk0\DR0 Suspicious object

The only other program that may tell is ASWmbr.

Quads

Re: Cannot boot computer after running Norton Power Eraser

B_chicago — Sun, 04 Mar 2012 06:17:35 GMT

I found the ASWmbr download from bleepingcomputer.com and will see what it detects. Thank you again.

Re: Cannot boot computer after running Norton Power Eraser

Quads — Sun, 04 Mar 2012 06:23:56 GMT

I have tried my system with Boot.Pihar and TDSSkiller with TLFS selected. Maybe an older variant.

MBR (0x1B8) (35a4fa451025305a24e864aaa8e364c9) \Device\Harddisk0\DR0
13:15:38.0979 4716 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected
13:15:38.0979 4716 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)
13:15:39.0004 4716 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
13:15:39.0004 4716 \Device\Harddisk0\DR0 - detected TDSS File System (1)

============================================================
13:15:39.0086 4716 Scan finished
13:15:39.0086 4716 ============================================================
13:15:39.0103 5120 Detected object count: 2
13:15:39.0103 5120 Actual detected object count: 2
13:15:48.0586 5120 \Device\Harddisk0\DR0\# - copied to quarantine
13:15:48.0586 5120 \Device\Harddisk0\DR0 - copied to quarantine
13:15:48.0610 5120 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine
13:15:48.0618 5120 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine
13:15:48.0622 5120 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine
13:15:48.0633 5120 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine
13:15:48.0642 5120 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine
13:15:48.0645 5120 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine
13:15:48.0647 5120 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine
13:15:48.0649 5120 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine
13:15:48.0652 5120 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine
13:15:48.0656 5120 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine
13:15:48.0658 5120 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot
13:15:48.0658 5120 \Device\Harddisk0\DR0 - ok
13:15:49.0456 5120 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure
13:15:49.0462 5120 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine
13:15:49.0472 5120 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine
13:15:49.0475 5120 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine
13:15:49.0487 5120 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine
13:15:49.0497 5120 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine
13:15:49.0499 5120 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine
13:15:49.0500 5120 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine
13:15:49.0516 5120 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine
13:15:49.0519 5120 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine
13:15:49.0523 5120 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine
13:15:49.0523 5120 \Device\Harddisk0\DR0\TDLFS - deleted
13:15:49.0523 5120 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete

But what I can see happens, Is if the partition TDLS becomes empty, for example Norton removes the files above inside the TDLFS, TDSSkiller finds the empty system but doesn't know what it is as it's empty.

Quads

Re: Cannot boot computer after running Norton Power Eraser

B_chicago — Sun, 04 Mar 2012 06:54:05 GMT

aswMBR did find some infected files. I attached the log. I have not fixed anything, though.