Jump to content

Pihar.C Rootkit Removal


Jayke

Recommended Posts

My mom's friend was having some troubles with her laptop, she gave the laptop to my mom and asked me if I would clean/disinfect it for her, from the start this has been a hard clean, all sorts of terrible stuff on the poor PC. There were the usual Junk/Fake programs, MyCleanPC, Registry Wizzard, Driver Fixer, etc... The darn thing had updates turned off from the start, so it had never been updated since the factory install of W7 in 2009. (It took 6 hours of just straight installing and restarting to get it up to date) But the thing that kept puzzling me was the fact that every 20-30 minutes or so, the computer would BSOD and restart and then act like nothing happened, I ignored this for the first day of cleaning, putting it off as "just some out-of-date drivers" or "junk hardware", but after I updated all of the drivers for the computer, (and there were a ton out of date), I stopped getting the BSOD for driver failiure, but was now getting BSODs for ntoskrnl.exe, ntkrnlmp.exe, and msahci.sys. all with the same frequency as before, about 30 minutes. getting sick of not being able to finish my scans, I downloaded TDSSkiller, and sure enough, a gleaming infection of Pihar.C and a TDSS filesystem ( :huh: ), after reading up on the internet, I have heard some people not being able to boot (BSOD 0x7b) after removing Pihar.c and its filesystem. The infection on the computer is located on \Device\Harddisk0\DR0 (both Pihar and the filesystem). I AM able to remove it, I have my finger on the button right now, I just am REALLY afraid of trashing my mom's friend's computer, can anybody give me any advice on how I would go about removing it without "detonating" it? (if any more info is needed just ask)
Thanks Everybody!  :D

 -Jayke

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.