winrscmde not able to be removed

[stupified]

I have a system that is infected with this rootkit (or at least it appears to be a rootkit since it monkeys with MBR) which was detected by malwarebytes but not mcafee or vipre. I tried to remove it with malwarebytes but the svchost *32 magically reappears after reboot. At this point I just want to backup my critical files and rebuild the system, however I don't want to bring any files over that may have been infected by winrscmde. e.g. jpg, wav, mp3, etc. Does anyone know what type of vectors this malware uses to propagate or remain persistent?

Thanks!

[jeffce]

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  
• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable (.exe) every time you run them

with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

---------

Please download DDS from either of these links

LINK 1

LINK 2

and save it to your desktop.

• Disable any script blocking protection
  
• Right-click and Run as Administrator dds to run the tool.
  
• When done, two DDS.txt's will open.
  
• Save both reports to your desktop.
  

---------------------------------------------------

Please include the contents of the following in your next reply:

DDS.txt

Attach.txt

----------

Please download TDSSKiller

• Double click TDSSKiller.exe
  
• Press Start Scan
  
• Do Not Attempt To Fix Anything Now. We just need to look over the report and be sure we are removing the correct
  items.
  
• Attach the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)
    

----------

[jeffce]

Do you still need help?

[stupified]

Hey Jeff,

I'm just going to rebuild the system.

thanks for your help!

[jeffce]

Ok thanks for letting me know.

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!