ESET still detecting "Kryptic Trojan/Rootkit" after I did all of "Read & Run"

SteamPunk · Dec 6, 2011

After I did all of "Read & Run" as well as "Windows XP Malware Removal" I decided to do another virus scan in which ESET picked up 5 infiltrations. It cleaned 4 of them but the one that remained (and the one which I've been trying to get rid of this whole time) was the Kryptic Trojan/Rootkit.

I have no idea how to remove this and any help would be appreciated.

Before you read the logs understand that this is not my computer. I'm visiting my dad over the holidays and he asked me to help him out with some of the problems he's been having. I know and agree with the stance you take on piracy/illegal software but I haven't been on this computer in almost six months and so don't know a lot of what's on there. Just thought you should know.

Thanks

SteamPunk · Dec 6, 2011

Last log.

TimW · Dec 6, 2011

Please attach the Eset log while I review your other logs.

And can I assume you fixed what MBAM found?

SteamPunk · Dec 6, 2011

Yes I did fix the things MBAM found. Sorry if that's not in the log.

I can't figure out how to upload the ESET log as a file so I'm just going to copy it here:

12/6/2011 10:39:13 AM Startup scanner file C:\WINDOWS\system32\DRIVERS\netbt.sys a variant of Win32/Rootkit.Kryptik.FW trojan unable to clean
12/5/2011 9:36:06 PM HTTP filter file http://software-files-l.cnet.com/s/...7648&isDlm=1&fileName=cnet2_revosetup_exe.exe a variant of Win32/InstallCore.D potentially unwanted application connection terminated - quarantined BDESKTOP\bob Threat was detected upon access to web by the application: C:\Program Files\SRWare Iron\iron.exe.
12/5/2011 9:32:52 PM HTTP filter file http://software-files-l.cnet.com/s/...7648&isDlm=1&fileName=cnet2_revosetup_exe.exe a variant of Win32/InstallCore.D potentially unwanted application connection terminated - quarantined BDESKTOP\bob Threat was detected upon access to web by the application: C:\Program Files\SRWare Iron\iron.exe.
12/5/2011 7:47:06 PM Real-time file system protection file C:\DOCUME~1\Stephen\LOCALS~1\Temp\Av-test.txt Eicar test file cleaned by deleting - quarantined BDESKTOP\Stephen Event occurred on a new file created by the application: C:\ComboFix\CF4821.3XE.
12/5/2011 3:28:43 PM Real-time file system protection file C:\System Volume Information\_restore{D772B3B2-7AA2-4AD8-BCC6-F75E639B6C84}\RP1071\A1118207.sys a variant of Win32/Rootkit.Kryptik.FW trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\system32\svchost.exe.
12/5/2011 9:36:13 AM Startup scanner file Operating memory » svchost.exe(1948) a variant of Win32/Sirefef.DT trojan unable to clean
12/5/2011 9:36:10 AM Startup scanner file Operating memory » \GLOBAL??\94fa56d1\WINDOWS\$NtUninstallKB49707$\2499434193\Desktop.ini a variant of Win32/Sirefef.DN trojan cleaned by deleting
12/5/2011 9:35:29 AM Startup scanner file C:\WINDOWS\system32\DRIVERS\netbt.sys a variant of Win32/Rootkit.Kryptik.FW trojan unable to clean
12/5/2011 7:29:52 AM Startup scanner file Operating memory » C:\WINDOWS\system32\sqlesw32.dll Win32/Wimpixo.AS trojan cleaned by deleting (after the next restart) - quarantined BDESKTOP\bob
12/5/2011 7:28:50 AM Startup scanner file Operating memory » svchost.exe(1948) a variant of Win32/Sirefef.DT trojan unable to clean BDESKTOP\bob
12/5/2011 7:28:39 AM Startup scanner file Operating memory » \GLOBAL??\94fa56d1\WINDOWS\$NtUninstallKB49707$\2499434193\Desktop.ini a variant of Win32/Sirefef.DN trojan cleaned by deleting BDESKTOP\bob
12/4/2011 10:38:21 PM Real-time file system protection file C:\System Volume Information\_restore{D772B3B2-7AA2-4AD8-BCC6-F75E639B6C84}\RP1068\A1116172.sys a variant of Win32/Rootkit.Kryptik.FW trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\system32\svchost.exe.
12/4/2011 10:15:56 PM Real-time file system protection file C:\System Volume Information\_restore{D772B3B2-7AA2-4AD8-BCC6-F75E639B6C84}\RP1068\A1115172.sys a variant of Win32/Rootkit.Kryptik.FW trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\system32\svchost.exe.
12/4/2011 9:17:28 PM Real-time file system protection file C:\System Volume Information\_restore{D772B3B2-7AA2-4AD8-BCC6-F75E639B6C84}\RP1068\A1115156.sys a variant of Win32/Rootkit.Kryptik.FW trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\system32\svchost.exe.
12/4/2011 8:17:42 PM Real-time file system protection file C:\System Volume Information\_restore{D772B3B2-7AA2-4AD8-BCC6-F75E639B6C84}\RP1068\A1114156.sys a variant of Win32/Rootkit.Kryptik.FW trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\system32\svchost.exe.
12/4/2011 7:27:22 PM HTTP filter archive http://at.aarrh.info/st.php HTML/Iframe.B.Gen virus connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/4/2011 7:27:22 PM HTTP filter archive http://at.aarrh.info/st.php HTML/Iframe.B.Gen virus connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/4/2011 7:26:17 PM HTTP filter archive http://at.aarrh.info/st.php HTML/Iframe.B.Gen virus connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/4/2011 7:26:16 PM HTTP filter archive http://at.aarrh.info/st.php HTML/Iframe.B.Gen virus connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/4/2011 9:00:55 AM HTTP filter file http://winter1.in/?4185e0f243f0d60fc80af58d148ef5c8 a variant of Win32/Kryptik.WQA trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/4/2011 9:00:24 AM HTTP filter file http://winter1.in/?4185e0f243f0d60fc80af58d148ef5c8 a variant of Win32/Kryptik.WQA trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/4/2011 7:11:22 AM Startup scanner file Operating memory » svchost.exe(1916) a variant of Win32/Sirefef.DT trojan unable to clean
12/4/2011 7:11:19 AM Startup scanner file Operating memory » \GLOBAL??\94fa56d1\WINDOWS\$NtUninstallKB49707$\2499434193\Desktop.ini a variant of Win32/Sirefef.DN trojan cleaned by deleting
12/4/2011 7:10:45 AM Startup scanner file C:\WINDOWS\system32\DRIVERS\netbt.sys a variant of Win32/Rootkit.Kryptik.FW trojan unable to clean
12/3/2011 10:13:15 PM Startup scanner file Operating memory » svchost.exe(1912) a variant of Win32/Sirefef.DT trojan unable to clean BDESKTOP\Stephen
12/3/2011 10:13:12 PM Startup scanner file Operating memory » \GLOBAL??\94fa56d1\WINDOWS\$NtUninstallKB49707$\2499434193\Desktop.ini a variant of Win32/Sirefef.DN trojan cleaned by deleting BDESKTOP\Stephen
12/3/2011 8:26:09 PM HTTP filter file http://designportal2.com/?59b3d5d0f71f16f14810ef6ce07373ff a variant of Win32/Kryptik.WPB trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/3/2011 8:22:15 PM HTTP filter file http://designportal2.com/?59b3d5d0f71f16f14810ef6ce07373ff a variant of Win32/Kryptik.WPB trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/3/2011 8:20:22 PM HTTP filter file http://designportal2.com/?59b3d5d0f71f16f14810ef6ce07373ff a variant of Win32/Kryptik.WPB trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/3/2011 8:20:18 PM Real-time file system protection file C:\WINDOWS\TEMP\0.48427216883045765.exe a variant of Win32/Kryptik.WPB trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a new file created by the application: C:\WINDOWS\system32\ping.exe.
12/3/2011 8:18:22 PM HTTP filter file http://designportal2.com/?59b3d5d0f71f16f14810ef6ce07373ff a variant of Win32/Kryptik.WPB trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/3/2011 8:14:52 PM HTTP filter file http://designportal2.com/?59b3d5d0f71f16f14810ef6ce07373ff a variant of Win32/Kryptik.WPB trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/3/2011 8:12:51 PM HTTP filter file http://designportal2.com/?59b3d5d0f71f16f14810ef6ce07373ff a variant of Win32/Kryptik.WPB trojan connection terminated - quarantined NT AUTHORITY\SYSTEM Threat was detected upon access to web by the application: C:\WINDOWS\system32\ping.exe.
12/3/2011 7:43:55 PM Real-time file system protection file C:\System Volume Information\_restore{D772B3B2-7AA2-4AD8-BCC6-F75E639B6C84}\RP1067\A1113049.sys a variant of Win32/Rootkit.Kryptik.FW trojan cleaned by deleting - quarantined NT AUTHORITY\SYSTEM Event occurred on a file modified by the application: C:\WINDOWS\system32\svchost.exe.
Click to expand...

Thank you very much for your help

TimW · Dec 7, 2011

Your logs are clean. What file is Eset detecting that you can't delete?

SteamPunk · Dec 7, 2011

Well you're right man. I found out that my dad just went ahead and got an IT guy to handle it over the weekend.

Sorry about that and thanks for all your help

TimW · Dec 7, 2011

No problem. Safe surfing.

Log in or Sign up

ESET still detecting "Kryptic Trojan/Rootkit" after I did all of "Read & Run"

SteamPunk Private E-2

Attached Files:

combolog.txt

mbam-log-2011-12-05 (13-40-39).txt

MGlogs.zip

RRLog.txt

SteamPunk Private E-2

Attached Files:

SASLog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SteamPunk Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SteamPunk Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

ESET still detecting "Kryptic Trojan/Rootkit" after I did all of "Read & Run"

SteamPunk Private E-2

Attached Files:

combolog.txt

mbam-log-2011-12-05 (13-40-39).txt

MGlogs.zip

RRLog.txt

SteamPunk Private E-2

Attached Files:

SASLog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SteamPunk Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

SteamPunk Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches