To start everything, let me start by what i do, and what are line of defense (this might give an overview):
1. I repair/build custom computers through spare parts for clients.
2. Line of defense:
*Avira Antivir Personal - I guess the best free antivirus because of high detection rate.
*Trojan Remover - for its fast scan at startup.
*Malwarebytes Antimalware - one of the most popular anti-malware.
*Ad-aware - for its real-time protection, Ad-Watch.
*Windows Defender - I not really sure if it does help though.
*USB Disk Security - For autoruns from USB drive, External Drives, CDs, DVDs
*Deepfreeze - everybody knows what it does. I only freeze the system drive.
I mostly have no problem with other malwares/viruses i have encountered, but this particular one made me age faster, lol.
There's this client who wanted to remove a certain virus from its computer. What I did is tried to eliminate the drive by reformatting the OS. What happened is that the storage partition, D:, in particular has an autorun which i can't eliminate... so after reformatting and installing some softwares, the malware again infected the computer's system. It took me 40 hours and 4 reformats, just to monitor it's behavior and eliminate the threat. The 4th reformat is a result of incapability to address the problem, i said the the client that's no way unrecoverable. I reformatted the computer, deleting and recreating every partition, and not back-upping any file at all.
The client's problem solved.
The problem now is that the threat is now on my computer. For the fact that my software installed after reformatting computers are installed at my computer. I have to use USB drive to get softwares from my computer, as a result i'm now infected too. My system is frozen by deepfreeze, so it's not effected or can effectively remove the effect of the threat by rebooting. The problem is, the autorun is in my other partition. I can't do anything to my system because i'm afraid once i unfreeze or thaw my system by deactivating deepfreeze, it will be stick on to my system, and becomes unrecoverable.
I have monitored for a while so that i can provide some description about the threat:
*Opening malwarebytes will open a warning box saying walwarebytes.exe can't be located, with an option abort, retry, continue. In irony, the malwarebytes software opens up and works as normal... and detects 5 registries affecting window policies.
*Disables AV, Trojan Remover (once detected TR tries to make an effort to remove the threat)
*Disable updates for AV
*Disable updates for firewall
*Disables Task Manager
*Disables Registry Editor
*Doesn't affect folder options
*Transferred mainly through USB or external drive (autorun)
*The autorun creates a random MS-Dos file with .pif extension (****.pif)
*autorun is hidden, undetectable by show hidden or by searching
*creates and amsint32.exe on system drive
*amsint32 activates a certain sptvbp.exe
*sptvbp.exe activates a certain jonjqn.sys on systemdrive:/windows/system32/drivers
*after jonjqn.sys is activated, the 5 registry policies are created
*amsint32, sptvbp.exe and jonjqn.sys is hidden and undetectable by show hidden files or by searching
*autorun is detectable by avira, malwarebytes, and trojan remover... as well as other removal softwares like rkill, combofix, regrun, ad-aware, usb disk security (on USB drive only), etc.
*These softwares can't effectively remove this autorun. Avira block it. Trojan remover, malwarebytes, combofix, rkill renames it. But another autorun is recreated every minute.
*amsint32, sptvbp.exe and jonjqn.sys is gone after activated. it activates with/after autorun activates. you can't really catch the by browsing. that is why they can't be found.
*that is also why and how these 3 entries evade software mentioned. they will be tried to be eliminated but software will require the computer to be rebooted. you can see on the log something like this: 5 policies - removed, autoruns - removed, amsint32 - not found, sptvbp.exe - not found, jonjqn.sys - not found.
*on one occasion, after the before the 3rd reformat in particular, the keyboard and mouses freezes whenever windows is logged. Only in windows, works on boot up, or bios. I'm not really sure if it's due to the malware though. it can be these software i have tried who eliminated and deleted some processes and system files.
I can't really provide you the logs because it is mostly on the client's computer and it's reformatted completely (no backup). I can't provide you logs from my computer either, because i have a frozen system drive. so bootup after anti-malware scan can't be done, thus, logs can't be flushed. I still am not sure if i would unfreeze my system drive just to get this logs, and risk my precious softwares (my source of living) deleted and unrecoverable.
I accept encouragement to unfreeze my system drive though.
thanks for future replies... and sorry for bad english and bad grammar.
