Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
I guess with a rootkit I'm not really sure what I have...pop-ups, redirecting websites, moderate slowing down of computer, error messages about not reading memory when offline, infostealer and a generically named "Trojan Horse" coming up in the symantec scan. I updated symantec and followed their site instructions. Nothing happened...any help would be greatly appreciated.
Disconnect the pc completely from the internet.
Check the plugins of the internet explorer. Some trojans do start automatically by this way, because parts of the internet explorer will be started during the windows startup process.When disconnected, check the processes in the task manager and try to stop suspicious processes.
Check your system again with Symantec Antivirus.
Clean all found viruses and trojans if possible.
Restart Windows and check the running processes in the task manager again.Are there again any suspicious processes.
If so, rightclick at my computer, manage, then click on services and try to figure out trojans services.Check all harddisks for an autorun.inf in it's root directory. This file is mostly hidden, so you must configure the settings, to show also the hidden files and folders.
If you'll find any autorun.inf in e.g. c:\ delete the file autorun.inf.After all, you have to restart again.
Please send a reply, if you solved the problem !!!
0 
(on an ancient laptop so I can access the forums)
I think I checked the Internet Explorer plugins. I went to the Downloaded Program Files folder in the Windows folder. Nothing fishy to my untrained eye. 3 identical java plugins, MUWeb from microsoft.com, and two shockwave flash files. All the websites in the properties tabs are legit sites.
I was able to end the processes ld08.exe (trojan horse) and 9129837.exe (infostealer) but other than cross-checking with files that symantec antivirus found...i'm not sure if I should shut anything else down in the task manager before I scan. Is there a handy list somewhere I can compare to or some way to know what to do for beginners? There's one program that shows the full name of the computer owner that keeps jumping up and down the list, but I'm wondering if that's just a normal process to log into the computer under her name at xp's startup? Sorry for the incompetence!And thank you so much for the fast reply!
0
Hi,
Can you please post your AVZ log:1) To create the logfile, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.
2) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.
3) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.
Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as AdministratorYou should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.
begin ExecuteStdScr(3); RebootWindows(true); end.Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called virusinfo_syscure.zip inside. Upload that file to rapidshare.com and paste the link here.
--------------------------------------------
To Private Message me Click Here
0
This depends on the viruses and trojans you get infected by.
Symantec, McAfee a.s.o. do have a virus library with descriptions on what such viruses and trojans do and how to get rid of them.Please send a reply, if you solved the problem !!!
0
avz.exe won't open or run at all. it's on my desktop, and not on a usb drive or anything weird like that. should I possibly rename it? I've tried both double clickin and right clicking and then open. Nothing.
0
Yes try to redownload it and rename it before it starts downloading. If that doesn't work try this one: http://www.malwarecrawler.com/a-v-z...
--------------------------------------------
To Private Message me Click Here
0
Run this script in AVZ like before. Your computer will reboot.
begin SetAVZGuardStatus(True); SearchRootkit(true, true); DeleteService('ws2_32sik'); StopService('ws2_32sik'); DeleteService('HTTPFilternSvcLog'); StopService('HTTPFilternSvcLog'); QuarantineFile('C:\WINDOWS\system32\digiwet.dll',''); QuarantineFile('C:\Documents and Settings\LocalService\.exe',''); QuarantineFile('msiconf.exe',''); QuarantineFile('C:\WINDOWS\System32\Drivers\a098us7r.SYS',''); QuarantineFile('C:\WINDOWS\system32\drivers\ws2_32sik.sys',''); QuarantineFile('C:\WINDOWS\system32\12520437j.exe',''); QuarantineFile('c:\windows\system32\sysdll.exe',''); QuarantineFile('c:\windows\pp10.exe',''); QuarantineFile('c:\windows\ld08.exe',''); QuarantineFile('c:\documents and settings\joan hite\joan hite.exe',''); QuarantineFile('c:\windows\9129837.exe',''); DeleteFile('c:\windows\9129837.exe'); DeleteFile('c:\documents and settings\joan hite\joan hite.exe'); DeleteFile('c:\windows\ld08.exe'); DeleteFile('c:\windows\pp10.exe'); DeleteFile('c:\windows\system32\sysdll.exe'); DeleteFile('C:\WINDOWS\system32\12520437j.exe'); DeleteFile('C:\WINDOWS\system32\drivers\ws2_32sik.sys'); DeleteFile('C:\WINDOWS\System32\Drivers\a098us7r.SYS'); DeleteFile('msiconf.exe'); DeleteFile('C:\Documents and Settings\LocalService\.exe'); DeleteFile('C:\WINDOWS\system32\digiwet.dll'); BC_ImportAll; ExecuteSysClean; ExecuteRepair(14); ExecuteRepair(15); BC_Activate; RebootWindows(true); end.After Reboot follow these steps.
Attach a Combofix log, please review and follow these instructions carefully.
Download it here -> http://download.bleepingcomputer.co...
Before Saving it to Desktop, please rename it to something like 123.exe to stop malware from disabling it.
Now, please make sure no other programs are running, close all other windows and pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) until after the scanning and removal process has taken place.
Please double click on the file you downloaded. Follow the onscreen prompts to start the scan. Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal.
You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.
Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please upload that file to rapidshare.com and paste the link here.
--------------------------------------------
To Private Message me Click Here
0
No! Crap, wait! I followed the directions, but I guess the click didn't actually go through when I tried to disable. Symantec was still running and you might get some false positives! I'll post an accurate log as soon as possible. Thank you for your patience!
0
Thanks. Please read steps carefully. Don't worry about it now. Run this script in AVZ your computer will reboot:
begin SetAVZGuardStatus(True); SearchRootkit(true, true); QuarantineFile('c:\windows\system32\1417529916.dat',''); DeleteFile('c:\windows\system32\1417529916.dat'); QuarantineFile('c:\windows\sto452730.dat',''); DeleteFile('c:\windows\sto452730.dat'); BC_ImportAll; ExecuteSysClean; BC_Activate; RebootWindows(true); end.After reboot follow these steps in order numbered:
1) Run this script in AVZ:
begin CreateQurantineArchive('c:\quarantine.zip'); end.2) A file called quarantine.zip should be created in C:\. Then please zip up C:\qoobox\quarantine and upload both it and C:\quarantine.zip to a filehost such as http://rapidshare.com/ Then, Private Message me the Download link to the uploaded file.
3) Lastly, uninstall Combofix by: pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) > Start > run > type combofix /u > ok.
--------------------------------------------
To Private Message me Click Here
0
Thanks for the files. Please follow these steps in order numbered and post log after each step.
1) If you use Windows System restore, turn it off > reboot. How to turn it off/on: http://support.kaspersky.com/faq/?q... Run a full scan with:
Download and run Kaspersky AVP tool:
http://devbuilds.kaspersky-labs.com...
Once you download and start the tool select all the objects/places to be scanned and hit Scan. Fix what it detects and at the end of the scan post screen shot/log of detected items that is fixed and which it could not fix.
2) Run a full scan with http://www.eset.eu/online-scanner
# Check the box next to YES, I accept the Terms of Use. # Click Start # When asked, allow the activex control to be installed. # Click Start # Check below options: * Remove found threats * Scan unwanted applications. # Click Scan # Wait for the scan to finish # When it finishes it will create a log file here: C:\Program Files\EsetOnlineScanner\log.txt # Attach this logfile to your next message.
Note: Turn system restore back on, if you wish; this to remove malware from system volume information files.3) Install, update and run full scan with Malwarebytes' Anti-Malware. Attach malwarebyte full scan log, but Please Don't fix anything yet, until the log is reviewed.
--------------------------------------------
To Private Message me Click Here
0
Kapersky detected 30, disinfected 0, and gave me a prompt to delete each one instead. Here is the screenshot of them after deletion:
http://rapidshare.com/files/2363750...Starting eset's online scan now.
0
Found 3 cleaned 3. Eset log:
http://rapidshare.com/files/2364005...Turning on system restore and starting Malwarebytes...
0
Fix what Malwarebytes detected.
"I guess with a rootkit I'm not really sure what I have...pop-ups, redirecting websites, moderate slowing down of computer, error messages about not reading memory when offline, infostealer and a generically named "Trojan Horse" coming up in the symantec scan. I updated symantec and followed their site instructions. Nothing happened...any help would be greatly appreciated."
Are all the problem fixed?
--------------------------------------------
To Private Message me Click Here
0
Wow. You are fast. Yes. The few problems I was experiencing haven't come back since last night after your first couple of scans. I can't believe how many different malware files you helped pull out of my computer. Thank you so much!
0
Your malware free. This for system clean up (optional). Run the following in order and fix what gets suggested.
1) http://onecare.live.com/site/en-Us/...
2) http://onecare.live.com/site/en-Us/...
3) http://www.superantispyware.com/dow...
Any original problems still persist after this let me know.
PS: i use http://www.computing.net/cgi-bin/my... (Computing.Net Buddy) Notifies me when one of my threads get replied :).
--------------------------------------------
To Private Message me Click Here
0  |
 |
 |
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
