My rootkit virus cannot get disinfected or deleted!

I tried using the tdsskiller program to delete the rootkit virus with no luck. then I tried using the virus removal tool and it still does not get rid of the virus. I am attaching the report. Can you send me a script to get rid of the virus? Tdsskiller keeps saying iaStorV.sys is infected.

Please help.

Thanks.

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual disinfection
[CODE]
begin
QuarantineFile('C:\Users\kunal.PAPERBAGS\AppData\Local\Temp\patch.exe','');
end.[/CODE]

Then [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL] in Manual disinfection
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]and upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.

Can't find that heading but i'll upload the file to this reply.
Sorry.

[size="1"][color="#666686"][B][I]Добавлено через 1 минуту[/I][/B][/color][/size]

Sorry, i just found it and uploaded it.

We have to check this file. If it's malicious - we'll try to remove it.

Thank you so much

The file seems to be clean.

But my kaspersky workstation 6.0 still detects rootkit.win32.TDSS.d virus. And it recommends to do a special disinfection procedure which demands system reboot. But when i say ok and it reboots, it keeps doing the same thing again.

Is there anything else I can do?

Thanks

[QUOTE=Kunal;635762]Is there anything else I can do?[/QUOTE]
Make a log of Vba32 AntiRootkit [url]http://virusinfo.info/showthread.php?t=78143[/url] [COLOR="Red"](only in ordinary-mode)[/COLOR]

Hi. Here is the zipped log file which i had to run through safemode as it would get a physical dump error if i ran through normal windows. I have attached it.

Thanks

Hello. Any luck? By the way i'm running windows 7.

Thanks

Make all recommendations only in normal mode!

but my computer gets an error in normal mode. is there something i should be doing?
thanks

[QUOTE=Kunal;635949]but my computer gets an error in normal mode.[/QUOTE]What kind of error? Or you cannot boot in normal mode at all?

Here we go. Please check this file.

Thanks

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual disinfection
[CODE]
begin
ClearQuarantine;
QuarantineFile('C:\Windows\System32\Drivers\atapi.sys','');
end.[/CODE]

Then [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL] in Manual disinfection
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]and upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.

1. Replace [B]C:\Windows\system32\DRIVERS\atapi.sys[/B] with a clean file from any similar system or from Windows CD using recovery console or Live CD.

2. Make a new log of Vba32 AntiRootkit.

the script is not generating the file for some reason. Can you recheck please?

Thanks

[size="1"][color="#666686"][B][I]Добавлено через 6 минут[/I][/B][/color][/size]

if i try to replace the atapi file, it says access denied. what shall i do?
thanks

[size="1"][color="#666686"][B][I]Добавлено через 1 минуту[/I][/B][/color][/size]

by the way, i'm trying to execute the script in kaspersky virus removal tool right?

[QUOTE=Kunal;635992]
if i try to replace the atapi file, it says access denied.[/QUOTE]How are you processing the replacement?

1. Burn a Linux Live CD
2. Memorize the location of atapi.sys, you will need to know this.
3. Get a working copy of windows on another machine or hard drive, navigate to the same directory on that system where the clean atapi.sys file is located, and copy to a flash drive.
4. Reboot the infected computer with the Live CD in it, it should load the disk.
5. Copy the clean file off the flash drive to the directory where the infected file is, and overwrite it. Alternatively, delete the infected file first before copying.
6. Reboot, and make sure the Live CD is out before it starts loading.

+ Aleksandra
If you'll have a problem with Linux try it in such way: [url]http://windows.microsoft.com/en-us/windows7/Create-a-system-repair-disc[/url]

when i try to delete the atapi file, it says access denied from trustedInstaller.

what does that mean?

thanks

[size="1"][color="#666686"][B][I]Добавлено через 21 минуту[/I][/B][/color][/size]

i don't know what to do with the system disk.

also, what is a linux live cd?

and the system never lets me delete or overwrite atapi.sys

How can i do it?

thanks

[size="1"][color="#666686"][B][I]Добавлено через 3 минуты[/I][/B][/color][/size]

i'm really stuck on this one.

Check your system with CureIt in Safe Mode.

where do i get cureit from?

[url]http://www.freedrweb.com/cureit/[/url]

[QUOTE=Kunal;636317]
i don't know what to do with the system disk.[/QUOTE]You have to boot your PC from it. So you could replace any file in the installed system. The same you have to do with Linux Disk or Dr.Web Live CD

shall i install cureit antivirus or security space?

[QUOTE=Kunal;636367]shall i install cureit antivirus or security space?[/QUOTE]You should not install anything! You have to BURN a Live CD and BOOT your system from it.