Need advice to analyze hard disk made unbootable by Trojan:JS/Medfos.B+Win32/Medfos.A versus MSE+GMER

[Art22]

Was running XP-SP3, IE8, Windows Firewall with MSE Microsoft Security Essentials when infected by Trojan:JS/Medfos.B continually respawning/quarantining. Pretty sure infected web page was http://www.santamonicadispatch.com/2011/06/class-action-suit-filed-against-city/&ei=OYYIUZK9I4GwMN3wgPAJ&sig2=XbPB2iPzsIN26PYSjRv-LA&ct=w.

Latest MSE update was couple of days ago. Was unable to have MSE update itself but was able to via Microsoft Update. With latest signature MSE also detected/quarantined Win32/Medfos.A and recommended full scan, which did (5 hours), but it did not stop Trojan:JS/Medfos.B respawning/quarantining during and after scan.

Ran GMER version previously downloaded 1/15/2013. Quick Scan, nothing. Proceded to full scan of C: but started getting error messages from Task Tray that GMER [name].exe file in different directories was corrupt. Went to look at those directories and unable to open them because corrupt. Each time error message recommended running Chkdsk to remedy corruption and restarting in Safe Mode. Finally stopped full GMER scan, tried to reboot into Safe Mode and, after browser opening by itself with message "navigation to the webpage was cancelled" and hanging a while, Windows shut down successfully. Upon starting up would not go beyond manufacturer spash screen (Toshiba) without booting at all or even allowing entry into BIOS. Computer powered up but was brain dead.

Swapped unbootable hard disk with emergency hard disk with factory installation last updated March 2012, updated MSE and ran Microsoft Update, which is setup from which I am writing.

I need to fix or at least salvage data from removed hard disk but would like guidance before daring to attach it as an external disk via USB to take a look. Don't want clean hard disk to get infected from external corrupt hard disk. Have GMER logs but on corrupt removed disk.

Thanks.

[gringo_pr]

Hello art22

I was going thru some old topics and noticed nobady responded to you - do you still need help with this?

gringo

[gringo_pr]

Hello

48 Hour bump

It has been more than 48 hours since my last post.

• do you still need help with this?
  
• do you need more time?
  
• are you having problems following my instructions?
  
• if after 48hrs you have not replied to this thread then it will have to be closed!
  

Gringo

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!