When MBR pirates grin as an indication of absolute pleasure!

Question

Someone, have no idea who, really worked my computer, and placed some rootkit, all-knowing, all-smashing malware something and I simply cannot keep Windows OS clean in a multiboot configuration with Ubuntu even after removing MBR, deleted all partitions and partition table, and reinstalled Ubuntu with Grub only, and no MBR.

The symptoms are, for the Windows part, that group policy rules are changed soon after establishing the internet connection and reboot computer. Local System is replaced by either SYSTEM and/or SERVICE and I can no longer find Local System when trying to restore the defaults, and it goes on like this with other locations/services, and I also find a lot of unknown executables inside the windows root folder, and system32 also with only one or two reboots after a fresh install of windows. When trying to install antivirus software I experience some delays, and only the firewall is able to block part of the unusual network activity.

Several attempts to reinstall Windows after installing Ubuntu were pathetic, I always seemed to get stuck to some point where the ugly malware rootkit something showed up and started doing its business as usual. I feel like being haunted and have no idea what to do or whether this nasty pirate is able to track me, and somehow infect my system again.

On top of all these, I recently noticed BIOS not being able to set time precisely, it is always a few hours backward. Is there anything I can do to erase this malware or to prevent further attacks? I've tried them all, antimalware, antivirus, antipirate software, and with very few results. I was thinking to delete all data on hard disk again, format and delete new MBR left from previous windows installs, and start it over using some Ubuntu Live Cd. Or maybe change my hard disk or what?

This is a new entry in my post as requested by user @mgjk who asked me to describe my problem with more details

As requested by @mgjk in his reply, I have to describe my problem using more details, and to be specific I think it is mostly about a virus described on this page, a virus/malware known as Trojan:Win32/Spyeye which may be, among others, related somehow to Systray .exe stub file usually located in /windows/system32. They say most AV software won't detect it, and I did try many solutions to eliminate it with no results.

I usually run WinXP, it is compatible with my ancient Dell machine. As for the specific symptoms, I sometimes could not have access to right-click menu commands in Windows, they were present but did not activate, or the taskbar did not show any of the open windows/apps, instead they were present on top of taskbar as if they were shrinked, and when it got really ugly I could not have access to most usual commands like stopping a process in Task Manager, using Regedit or editing system rules and policy using Gpedit.msc tool.

As already told in a previous comment, my ISP told me to install Kaspersky AV, latest release, and after first reboot I got yet another thingy on my Windows, which is known as das boot virus or something like that. Great idea, what can I tell, use Kaspersky to get rid of Spyeye. I should have known better.

Answer 1

A totally different angle on this would be to step back and consider your analysis.

• You have a hypothesis that your machine is infected with malware.

• You are collecting evidence through your attempt to build the machine into a dual boot configuration.

To determine if it is true that you have malware, you'll need to come up with a test of this hypothesis. The test might be to demonstrate well documented behaviour which cannot be explained by experts on the OS, or well documented behaviour which cannot be reproduced. I personally document this stuff with pen, paper and a camera.

You performed some installations and have observed unusual results, but your observations aren't well documented (at least here).

• "Windows OS" - What version of Windows?

• "A lot of unknown executables" - Do you have a list?

• "Local System is replaced by either SYSTEM and/or SERVICE and I can no longer find Local System when trying to restore the defaults" - where? how did you check?

• "When trying to install antivirus software I experience some delays, and only the firewall is able to block part of the unusual network activity" - what unusual traffic did you detect? How long are the delays? when do they occur?

• "I always seemed to get stuck to some point where the ugly malware rootkit something showed up and started doing its business as usual" - When do you get stuck? What prevents you from continuing?

Having precise information about any one of these unusual behaviours could help. There may be a non-malware explanation for the problems, or you may document behaviour unique to a very specific bit of malware.

Regarding your clock: Setting the clock back a few hours in the BIOS sounds like normal multiboot behaviour. Some OSes store the time zone as UTC, some store it as local time. This is usually only noticable in a dual boot configuration See further: https://superuser.com/questions/185773/does-windows-7-support-utc-as-bios-time

You can test the theory by booting to one os, checking the time, shutting down, checking the time in the BIOS, then repeating for the other OS. If you can resolve the issue or influence the hours by changing the way the OS stores the time or even the time zone in the OS, then you have pretty good evidence that you've identified the cause.

Answer 2

It might actually be worse than the comments suggest. Example: If you are on your own home network, is it possible that other machines in your network are infected? If they are, that would explain the persistent re-infection after wiping and wiping and wiping and wiping. That being said. . .

Step One: Isolate all of the machines on your network. All of them. Do not let them talk to each other or connect to the internet, or anything.

Step Two: Get a CD that you can boot from.

Step Three: Boot a machine with your CD, connect to your home router and firewall off all incoming traffic. All of it.

Step Four: Boot the machines with your boot CD, find out if they are infected, wipe the disks and the MBRs, and start fresh.

Repeat ad nauseum until it's dead. Grind it into oblivion.

EDIT: Also, you might want to check any external storage for malware. Just to be safe.