Man…every client I’ve seen for the past 2 weeks who was infected with malware also had this Atapi.sys rootkit. I know I’ve written about this about 2 weeks ago, but I wanted to keep this fresh. If you’re searches are getting redirected and you’ve scanned with just about every thing you can think of then there’s a pretty good chance your atapi.sys has been patched (Microsoft Security Essentials detects a spawned dll from this rootkit…I think it’s called AlureonCT).
One easy way to find out if you have a patched Atapi.sys is to run the latest copy of GMER Anti-RootKit. Upon opening GMER it will run a very fast quick scan. If you see any entries like \DEVICEHARDDISK\Atapi (something like that) or Atapi.sys “suspicious modification” (especially this one) then your probably dealing with a very nasty rootkit.
For clients that run Windows XP I’ve just been using Combofix (Combofix disinfects Atapi.sys). For other operating systems (32-bit) I’ve just been using a bootable anti-malware disc (bartpe) and replacing atapi.sys with one from the Windows disc.